CVE-2026-39892

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

References

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39892.json

https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq

https://bugzilla.redhat.com/show_bug.cgi?id=2456735

https://access.redhat.com/security/cve/CVE-2026-39892

https://access.redhat.com/errata/RHSA-2026:7295

https://access.redhat.com/errata/RHSA-2026:46956

https://access.redhat.com/errata/RHSA-2026:43855

https://access.redhat.com/errata/RHSA-2026:43854

https://access.redhat.com/errata/RHSA-2026:43853

https://access.redhat.com/errata/RHSA-2026:43851

https://access.redhat.com/errata/RHSA-2026:43670

https://access.redhat.com/errata/RHSA-2026:43651

https://access.redhat.com/errata/RHSA-2026:42644

https://access.redhat.com/errata/RHSA-2026:37275

https://access.redhat.com/errata/RHSA-2026:30089

https://access.redhat.com/errata/RHSA-2026:30088

https://access.redhat.com/errata/RHSA-2026:24977

https://access.redhat.com/errata/RHSA-2026:24866

https://access.redhat.com/errata/RHSA-2026:24853

https://access.redhat.com/errata/RHSA-2026:24762

https://access.redhat.com/errata/RHSA-2026:24761

https://access.redhat.com/errata/RHSA-2026:24483

https://access.redhat.com/errata/RHSA-2026:23361

https://access.redhat.com/errata/RHSA-2026:22840

https://access.redhat.com/errata/RHSA-2026:22629

https://access.redhat.com/errata/RHSA-2026:22465

https://access.redhat.com/errata/RHSA-2026:21017

https://access.redhat.com/errata/RHSA-2026:20338

https://access.redhat.com/errata/RHSA-2026:19375

http://www.openwall.com/lists/oss-security/2026/04/08/12

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS