← CVE Intelligence

CVE-2026-39892

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs PUBLISHED

Description (CNA)

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Affected (CNA)

Vendor / productVersions
pyca / cryptographyaffected >= 45.0.0, < 46.0.7

CWE

CWE-119

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.