Live › vulnerability › CVE-2026-39892
The Python cryptography library mishandles non-contiguous buffers passed to APIs such as Hash.update(), so reads can run past the end of the buffer. The advisory rates it critical (CVSS 9.8), and the sources do not state what an attacker can get beyond memory over-read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 03:21 UTC, 0h before NVD. All times on this page are UTC.
Python applications that install the cryptography package at versions 45.0.0 up to but not including 46.0.7 and pass non-contiguous buffers, such as reversed or strided slices, into its APIs. The advisory's example uses Hash.update() on Python above 3.11. Teams whose code only passes contiguous bytes, or who run versions outside the affected range, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| cryptography | pypi | >= 45.0.0, < 46.0.7 | 46.0.7 |
| cryptography.io cryptography | vendor | >= 45.0.0, < 46.0.7 | 46.0.7 |
pip show cryptographyHash.update() or other cryptography APIs that receive sliced or reversed buffers, such as buf[::-1]cryptography 46.0.7 (affected range >= 45.0.0, < 46.0.7)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-39892")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.