{"id":"CVE-2026-39892","title":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers","summary":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this …","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-119","CWE-131"],"vendor":"cryptography.io","product":"cryptography","affected":["cryptography >= 45.0.0, < 46.0.7"],"patched":["cryptography 46.0.7"],"published":"2026-04-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:20:00.007","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39892","references":[{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq","label":"security-advisories@github.com"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/08/12","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20338","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21017","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22465","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22629","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22840","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23361","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24483","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24761","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24762","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24853","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30089","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43651","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43670","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43851","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43853","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43854","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43855","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46956","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7295","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-39892","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456735","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39892.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39892"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39892"},{"url":"https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5"},{"url":"https://github.com/pyca/cryptography"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-36.yaml"}],"tags":["nvd","cve.org","csaf","vex","red-hat","osv","pip","score-dispute"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-04-09T19:41:57.662246Z"},"scores":{"nvd":9.8,"cna":6.9,"vendor":7.3},"epss":0.00652,"epssPercentile":0.49466,"ingestedAt":"2026-07-01T15:50:58.769Z","aliases":["GHSA-p423-j2cm-9vmq","PYSEC-2026-36"],"ecosystem":"pip","slug":"CVE-2026-39892","body":"## Overview\n\ncryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.\n\n## Affected\n\n- `cryptography >= 45.0.0, < 46.0.7`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `cryptography 46.0.7`\n\n## Vendor advisories\n\n- **RHSA-2026:24761** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24761)\n- **RHSA-2026:24762** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24762)\n- **RHSA-2026:30089** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30089)\n- **RHSA-2026:30088** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:30088)\n- **RHSA-2026:24866** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24866)\n- **RHSA-2026:20338** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20338)\n- **RHSA-2026:43855** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43855)\n- **RHSA-2026:43854** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43854)\n- **RHSA-2026:43851** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43851)\n- **RHSA-2026:43670** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43670)\n- **RHSA-2026:43853** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43853)\n- **Red Hat VEX** · Important · affected: Lightspeed Core, Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat Enterprise Linux 8, … · no fix planned: Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Quay 3, Lightspeed Core, … · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39892.json)\n\n## Package advisory (CVE-2026-39892)\n\nAffected packages:\n\n- `cryptography >= 45.0.0, < 46.0.7`\n\nPatched in:\n\n- `cryptography 46.0.7`\n\nSource: https://osv.dev/vulnerability/GHSA-p423-j2cm-9vmq","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}