---
id: "CVE-2026-39892"
kind: "vulnerability"
aliases: ["CVE-2026-39892", "GHSA-p423-j2cm-9vmq"]
title: "Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs"
severity: "critical"
cvss: 9.8
epss: 0.00652
exploited: false
status: "open"
category: "package"
products: [{"name": "cryptography", "fixed": ["46.0.7"], "affected": ">= 45.0.0, < 46.0.7", "ecosystem": "pypi"}, {"name": "cryptography.io cryptography", "fixed": ["46.0.7"], "affected": ">= 45.0.0, < 46.0.7", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["cryptography", "cwe-119", "cwe-131", "package", "pypi", "python"]
not_affected_if: ["contiguous-buffers-only", "version-46.0.7-or-newer", "version-below-45"]
published_at: "2026-04-08T19:23:08+00:00"
first_seen_at: "2026-11-04T03:21:06+00:00"
updated_at: "2026-11-04T03:46:40+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-p423-j2cm-9vmq", "first_seen_at": "2026-11-04T03:21:06+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892", "first_seen_at": "2026-11-04T03:46:40+00:00"}]
---

# Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

The Python cryptography library mishandles non-contiguous buffers passed to APIs such as Hash.update(), so reads can run past the end of the buffer. The advisory rates it critical (CVSS 9.8), and the sources do not state what an attacker can get beyond memory over-read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:cryptography affected >= 45.0.0, < 46.0.7 fixed 46.0.7
- vendor:cryptography.io cryptography affected >= 45.0.0, < 46.0.7 fixed 46.0.7

## How to check

- Check the installed version with `pip show cryptography`
- Look for calls to `Hash.update()` or other cryptography APIs that receive sliced or reversed buffers, such as `buf[::-1]`
- Confirm the Python version in use, since the advisory says the read happens on Python above 3.11

## Fix

- `cryptography` `46.0.7` (affected range `>= 45.0.0`, `< 46.0.7`)

## Timeline

- 2026-11-04T03:21:06+00:00 ghsa https://github.com/advisories/GHSA-p423-j2cm-9vmq
- 2026-11-04T03:46:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-39892

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/pyca/cryptography/security-advisories/GHSA-p423-j2cm-9vmq
- [advisory] Maintainer's advisory: github.com https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq
- [fix] Patch: github.com https://github.com/pyca/cryptography/commit/c09d38ae52de7d95fe683b7a7c496f5751616f27
- [fix] Patch: github.com https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5
- [fix] Release notes: www.openwall.com http://www.openwall.com/lists/oss-security/2026/04/08/12

## From the sources

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_