{"id":"CVE-2026-39892","kind":"vulnerability","aliases":["CVE-2026-39892","GHSA-p423-j2cm-9vmq"],"related":[],"title":"Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.","summary":"The Python cryptography library mishandles non-contiguous buffers passed to APIs such as Hash.update(), so reads can run past the end of the buffer. The advisory rates it critical (CVSS 9.8), and the sources do not state what an attacker can get beyond memory over-read.","severity":"critical","cvss":9.8,"epss":0.00652,"exploited":false,"exploited_at":null,"products":[{"name":"cryptography","fixed":["46.0.7"],"affected":">= 45.0.0, < 46.0.7","ecosystem":"pypi"},{"name":"cryptography.io cryptography","fixed":["46.0.7"],"affected":">= 45.0.0, < 46.0.7","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cryptography","cwe-119","cwe-131","package","pypi","python"],"not_affected_if":["contiguous-buffers-only","version-46.0.7-or-newer","version-below-45"],"how_to_check":"- Check the installed version with `pip show cryptography`\n- Look for calls to `Hash.update()` or other cryptography APIs that receive sliced or reversed buffers, such as `buf[::-1]`\n- Confirm the Python version in use, since the advisory says the read happens on Python above 3.11","fix":"- `cryptography` `46.0.7` (affected range `>= 45.0.0`, `< 46.0.7`)","status":"open","published_at":"2026-04-08T19:23:08+00:00","first_seen_at":"2026-11-04T03:21:06+00:00","triaged_at":"2026-11-04T03:22:18+00:00","updated_at":"2026-11-04T03:46:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T03:22:18Z","model":"claude-haiku-5-5","output":{"fix":"- `cryptography` `46.0.7` (affected range `>= 45.0.0`, `< 46.0.7`)","reach":"unknown","title":"cryptography: non-contiguous buffers passed to hashing APIs overflow memory","impact":"medium","summary":"The Python cryptography library mishandles non-contiguous buffers passed to APIs such as Hash.update(), so reads can run past the end of the buffer. The advisory rates it critical (CVSS 9.8), and the sources do not state what an attacker can get beyond memory over-read.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","cryptography","pypi"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"out-of-bounds memory reads in cryptography calls, possibly crashes","analyst_note":"Check the GHSA advisory for whether the over-read can be triggered from attacker-controlled input and whether it leads to more than a crash.","how_to_check":"- Check the installed version with `pip show cryptography`\n- Look for calls to `Hash.update()` or other cryptography APIs that receive sliced or reversed buffers, such as `buf[::-1]`\n- Confirm the Python version in use, since the advisory says the read happens on Python above 3.11","plain_action":"","needs_analyst":true,"not_affected_if":["version-below-45","version-46.0.7-or-newer","contiguous-buffers-only"],"who_is_affected":"Python applications that install the cryptography package at versions 45.0.0 up to but not including 46.0.7 and pass non-contiguous buffers, such as reversed or strided slices, into its APIs. The advisory's example uses Hash.update() on Python above 3.11. Teams whose code only passes contiguous bytes, or who run versions outside the affected range, can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000763,"input_tokens":4261,"output_tokens":674,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-119':31B '-131':33B '-2026':16A,24A '-39892':17A,25A '45.0.0':100C '46.0.7':103C,131C '9.8':68B '9vmq':22A 'accept':115C 'advisori':63B 'api':14A,48B,113C 'attack':77B 'beyond':80B 'buffer':4A,10A,45B,61B,109C,117C,124C 'contigu':9A,44B,108C 'could':121C 'critic':66B 'cryptograph':92C 'cryptographi':1A,29B,39B,85C 'cryptography':26A,28A 'cryptography.io':27A 'cve':15A,23A 'cvss':67B 'cwe':30B,32B 'design':89C 'develop':98C 'e.g':118C 'end':58B 'expos':91C 'fix':129C 'get':79B 'ghsa':19A 'ghsa-p423-j2cm-9vmq':18A 'hash.update':51B,119C 'j2cm':21A 'lead':122C 'librari':40B 'memori':81B 'mishandl':41B 'non':8A,43B,107C 'non-contigu':7A,42B,106C 'over-read':82B 'overflow':5A,125C 'p423':20A 'packag':34B,88C 'pass':12A,46B,111C 'past':56B 'primit':93C 'pypi':35B 'python':36B,38B,97C,116C 'rate':64B 'read':53B,84B 'recip':95C 'run':55B 'sourc':71B 'state':74B 'vulner':2A,127C","nicknames":[],"mitigations":[],"who_affected":"Python applications that install the cryptography package at versions 45.0.0 up to but not including 46.0.7 and pass non-contiguous buffers, such as reversed or strided slices, into its APIs. The advisory's example uses Hash.update() on Python above 3.11. Teams whose code only passes contiguous bytes, or who run versions outside the affected range, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["cryptography","cryptographyiocryptography"],"ptokens":["cryptography","io"],"labels":["critical","cryptography","cwe119","cwe131","package","pypi","python","vendor"],"campaign_type":null,"first_public_at":"2026-04-08T01:50:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-p423-j2cm-9vmq","url":"https://github.com/advisories/GHSA-p423-j2cm-9vmq","severity":"medium","published_at":"2026-04-08T19:23:08+00:00","modified_at":"2026-11-04T03:16:32+00:00","first_seen_at":"2026-11-04T03:21:06+00:00","fetched_at":"2026-11-04T03:21:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-39892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39892","severity":null,"published_at":"2026-04-08T21:17:01+00:00","modified_at":"2026-09-10T13:20:00+00:00","first_seen_at":"2026-11-04T03:46:40+00:00","fetched_at":"2026-11-04T03:46:40+00:00","note":null}],"documents":[{"id":63570,"url":"https://api.github.com/repos/pyca/cryptography/security-advisories/GHSA-p423-j2cm-9vmq","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":63571,"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-04-08T01:50:53+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63572,"url":"https://github.com/pyca/cryptography/commit/c09d38ae52de7d95fe683b7a7c496f5751616f27","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63573,"url":"https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":63827,"url":"http://www.openwall.com/lists/oss-security/2026/04/08/12","title":"Release notes: www.openwall.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: www.openwall.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}