---
id: CVE-2024-26130
aliases:
  - GHSA-6vqw-3v5j-54x4
  - PYSEC-2024-225
title: >-
  cryptography NULL pointer dereference with
  pkcs12.serialize_key_and_certificates when called with a non-matching
  certificate and private …
summary: >-
  cryptography NULL pointer dereference with
  pkcs12.serialize_key_and_certificates when called with a non-matching
  certificate and private key and an hmac_hash override
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: cryptography
product: cryptography
ecosystem: pip
affected:
  - 'cryptography >= 38.0.0, < 42.0.4'
patched:
  - cryptography 42.0.4
published: '2024-02-21'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:09.815640629Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6vqw-3v5j-54x4'
references:
  - url: >-
      https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-26130'
  - url: 'https://github.com/pyca/cryptography/pull/10423'
  - url: >-
      https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55
  - url: 'https://github.com/pyca/cryptography'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2024-225.yaml
tags:
  - osv
  - pip
epss: 0.00831
epssPercentile: 0.55782
ingestedAt: '2026-09-12T03:13:01.668Z'
---

## Overview

If `pkcs12.serialize_key_and_certificates` is called with both:

1. A certificate whose public key did not match the provided private key
2. An `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`

Then a NULL pointer dereference would occur, crashing the Python process.

This has been resolved, and now a `ValueError` is properly raised.

Patched in https://github.com/pyca/cryptography/pull/10423

## Affected packages

- `cryptography >= 38.0.0, < 42.0.4`

## Remediation

Upgrade to a patched release:

- `cryptography 42.0.4`