CVE-2026-39892

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

6.9 MediumFix available

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.68%Up 0.6 points since Apr 9, 2026

What each source reports

CVE List Score used 6.9

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

Record: CVE-2026-39892
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-119, CWE-131
Updated: 2026-11-04

EUVDEUVD-2026-20640 6.9

Record: EUVD-2026-20640
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated: 2026-11-04

GitHub AdvisoriesGHSA-p423-j2cm-9vmq 6.9

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. For example:

h = Hash(SHA256())
b.update(buf[::-1])

would read past the end of the buffer on Python >3.11

Record: GHSA-p423-j2cm-9vmq
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-119, CWE-131
Updated: 2026-11-04

NVD 6.9

Record: CVE-2026-39892
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-119, CWE-131
Updated: 2026-11-04

OSVALPINE-CVE-2026-39892 9.8

Record: ALPINE-CVE-2026-39892
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-39892 9.8

Record: BELL-CVE-2026-39892
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 10 moreShow less

OSV 6.9

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

Record: CVE-2026-39892
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness: CWE-119
Updated: 2026-11-05

OSVDEBIAN-CVE-2026-39892 9.8

Record: DEBIAN-CVE-2026-39892
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-04

OSVGHSA-p423-j2cm-9vmq 6.9

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. For example:

h = Hash(SHA256())
b.update(buf[::-1])

would read past the end of the buffer on Python >3.11

Record: GHSA-p423-j2cm-9vmq
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-119, CWE-131
Updated: 2026-11-04

OSVPYSEC-2026-36 9.8

Record: PYSEC-2026-36
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:24761 7.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record: RHSA-2026:24761
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:24762 8.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record: RHSA-2026:24762
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:7295 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:7295
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVROOT-APP-PYPI-CVE-2026-39892 5.3

CVE-2026-39892 in cryptography - Patched by Root

Root has patched CVE-2026-39892 in the cryptography package for Root:PyPI. Multiple fixed versions available.

Record: ROOT-APP-PYPI-CVE-2026-39892
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVCLSA-2026-1778028237 No score

TuxCare security update for cryptography (1 CVE)

TuxCare rebuilt cryptography to address 1 CVE. Fixed in 45.0.7.post2+tuxcare.

Record: CLSA-2026-1778028237
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10535-1 No score

python311-cryptography-46.0.7-1.1 on GA media

These are all security issues fixed in the python311-cryptography-46.0.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10535-1
Updated: 2026-11-02

Affected products

Show 20 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`cryptography` PyPI	45.0.0 up to 46.0.7	46.0.7
`py3-cryptography` Alpine:v3.23	45.0.0 up to 46.0.7-r0	46.0.7-r0
`py3-cryptography` Alpine:v3.24	45.0.0 up to 46.0.7-r0	46.0.7-r0
`py3-cryptography` Alpaquita:stream	39.0.2-r0 up to 46.0.7-r0	46.0.7-r0
`cryptography` TuxCare:PyPI	45.0.7 up to 45.0.7.post2+tuxcare, plus listed versions 45.0.7.post1+tuxcare	45.0.7.post2+tuxcare
`python-cryptography` Debian:14	before 46.0.7-1, plus listed versions 43.0.0-344.0.2-144.0.2-245.0.6-145.0.6-1~exp1 Show 6 moreShow less 45.0.7-146.0.1-146.0.1-1~exp146.0.5-146.0.5-246.0.6-1	46.0.7-1
`cryptography` PyPI	45.0.0 up to 46.0.7, plus listed versions 45.0.145.0.245.0.345.0.445.0.5 Show 9 moreShow less 45.0.645.0.746.0.046.0.146.0.246.0.346.0.446.0.546.0.6	46.0.7
`automation-gateway-server` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs	before 0:2.5.20260422-3.el8ap	0:2.5.20260422-3.el8ap
`automation-gateway-server` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs	before 0:2.5.20260422-3.el9ap	0:2.5.20260422-3.el9ap
`python3.12-click` Red Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 16 CVEs	before 0:8.3.3-1.el8ap	0:8.3.3-1.el8ap

Show 67 moreShow less

Affected packages
Package	Affected	Fixed
`python3.12-click` Red Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 16 CVEs	before 0:8.3.3-1.el8ap	0:8.3.3-1.el8ap
`python3.12-click` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs	before 0:8.3.3-1.el8ap	0:8.3.3-1.el8ap
`python3.12-click` Red Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 16 CVEs	before 0:8.3.3-1.el9ap	0:8.3.3-1.el9ap
`python3.12-click` Red Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 16 CVEs	before 0:8.3.3-1.el9ap	0:8.3.3-1.el9ap
`python3.12-click` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs	before 0:8.3.3-1.el9ap	0:8.3.3-1.el9ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs	before 0:4.6.29-2.el8ap	0:4.6.29-2.el8ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs	before 0:4.6.29-2.el9ap	0:4.6.29-2.el9ap
`receptor` Red Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 16 CVEs	before 0:1.6.5-1.el8ap	0:1.6.5-1.el8ap
`receptor` Red Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 16 CVEs	before 0:1.6.5-1.el8ap	0:1.6.5-1.el8ap
`automation-gateway-proxy-server` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs	before 0:2.5.10-6.el8ap	0:2.5.10-6.el8ap
`receptor` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs	before 0:1.6.5-1.el8ap	0:1.6.5-1.el8ap
`receptor` Red Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 16 CVEs	before 0:1.6.5-1.el9ap	0:1.6.5-1.el9ap
`receptor` Red Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 16 CVEs	before 0:1.6.5-1.el9ap	0:1.6.5-1.el9ap
`automation-gateway-proxy-server` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs	before 0:2.6.14-3.el9ap	0:2.6.14-3.el9ap
`receptor` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs	before 0:1.6.5-1.el9ap	0:1.6.5-1.el9ap
`python3.12-cryptography` Red Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 16 CVEs	before 0:46.0.7-1.el8ap	0:46.0.7-1.el8ap
`python3.12-cryptography` Red Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 16 CVEs	before 0:46.0.7-1.el8ap	0:46.0.7-1.el8ap
`python3.12-cryptography` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs	before 0:46.0.7-1.el8ap	0:46.0.7-1.el8ap
`python3.12-cryptography` Red Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 16 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-cryptography` Red Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 16 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-cryptography` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-pillow` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs	before 0:12.2.0-1.el8ap	0:12.2.0-1.el8ap
`python3.12-pillow` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs	before 0:12.2.0-1.el9ap	0:12.2.0-1.el9ap
`automation-platform-ui` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:2.6.9-1.el9ap	0:2.6.9-1.el9ap
`python3-click` Red Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 12 CVEs	before 0:8.3.3-1.el10ap	0:8.3.3-1.el10ap
`python3-click` Red Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs	before 0:8.3.3-1.el10ap	0:8.3.3-1.el10ap
`python3.12-click` Red Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs	before 0:8.3.3-1.el9ap	0:8.3.3-1.el9ap
`python3.12-click` Red Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs	before 0:8.3.3-1.el9ap	0:8.3.3-1.el9ap
`python3.12-click` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:8.3.3-1.el9ap	0:8.3.3-1.el9ap
`automation-controller` Red Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs	before 0:4.7.12-1.el9ap	0:4.7.12-1.el9ap
`automation-controller-cli` Red Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs	before 0:4.7.12-1.el9ap	0:4.7.12-1.el9ap
`automation-controller` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:4.7.12-1.el9ap	0:4.7.12-1.el9ap
`automation-controller-cli` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:4.7.12-1.el9ap	0:4.7.12-1.el9ap
`automation-controller-server` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:4.7.12-1.el9ap	0:4.7.12-1.el9ap
`automation-controller-ui` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:4.7.12-1.el9ap	0:4.7.12-1.el9ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:4.7.12-1.el9ap	0:4.7.12-1.el9ap
`receptor` Red Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs	before 0:1.6.5-1.el10ap	0:1.6.5-1.el10ap
`receptor-debuginfo` Red Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs	before 0:1.6.5-1.el10ap	0:1.6.5-1.el10ap
`receptor-debugsource` Red Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs	before 0:1.6.5-1.el10ap	0:1.6.5-1.el10ap
`receptorctl` Red Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs	before 0:1.6.5-1.el10ap	0:1.6.5-1.el10ap
`receptor` Red Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs	before 0:1.6.5-1.el9ap	0:1.6.5-1.el9ap
`receptorctl` Red Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs	before 0:1.6.5-1.el9ap	0:1.6.5-1.el9ap
`receptor` Red Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs	before 0:1.6.5-1.el9ap	0:1.6.5-1.el9ap
`receptorctl` Red Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs	before 0:1.6.5-1.el9ap	0:1.6.5-1.el9ap
`automation-gateway-proxy` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:2.6.14-3.el9ap	0:2.6.14-3.el9ap
`automation-gateway-proxy-debugsource` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:2.6.14-3.el9ap	0:2.6.14-3.el9ap
`automation-gateway-proxy-server` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:2.6.14-3.el9ap	0:2.6.14-3.el9ap
`automation-gateway-proxy-server-debuginfo` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:2.6.14-3.el9ap	0:2.6.14-3.el9ap
`receptor` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:1.6.5-1.el9ap	0:1.6.5-1.el9ap
`receptor-debuginfo` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:1.6.5-1.el9ap	0:1.6.5-1.el9ap
`receptor-debugsource` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:1.6.5-1.el9ap	0:1.6.5-1.el9ap
`receptorctl` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:1.6.5-1.el9ap	0:1.6.5-1.el9ap
`python3.12-cryptography` Red Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-cryptography-debuginfo` Red Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-cryptography-debugsource` Red Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-cryptography` Red Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-cryptography-debuginfo` Red Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-cryptography-debugsource` Red Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-cryptography` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-cryptography-debuginfo` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-cryptography-debugsource` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:46.0.7-1.el9ap	0:46.0.7-1.el9ap
`python3.12-pillow` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:12.2.0-1.el9ap	0:12.2.0-1.el9ap
`python3.12-pillow-debuginfo` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:12.2.0-1.el9ap	0:12.2.0-1.el9ap
`python3.12-pillow-debugsource` Red Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs	before 0:12.2.0-1.el9ap	0:12.2.0-1.el9ap
`python-cryptography` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:46.0.7-1.hum1	0:46.0.7-1.hum1
`cryptography` Root:PyPI	before 46.0.6+aikido.5	46.0.6+aikido.546.0.5+aikido.746.0.3+aikido.846.0.4+aikido.545.0.7+aikido.545.0.5+aikido.946.0.1+aikido.646.0.1+aikido.146.0.1+aikido.246.0.6+aikido.146.0.3+aikido.946.0.5+aikido.345.0.5+aikido.546.0.1+aikido.346.0.4+aikido.346.0.3+aikido.446.0.6+aikido.245.0.7+aikido.145.0.7+aikido.246.0.4+aikido.446.0.5+aikido.445.0.7+aikido.346.0.1+aikido.446.0.3+aikido.546.0.6+aikido.345.0.5+aikido.646.0.5+aikido.545.0.5+aikido.745.0.5+aikido.846.0.5+aikido.645.0.7+aikido.446.0.3+aikido.646.0.3+aikido.746.0.1+aikido.546.0.6+aikido.445.0.5+aikido.1045.0.7+aikido.646.0.1+aikido.746.0.5+aikido.846.0.6+aikido.646.0.4+aikido.646.0.3+aikido.1046.0.4+aikido.7
`python-cryptography` openSUSE:Tumbleweed	before 46.0.7-1.1	46.0.7-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	references	EUVD, NVD, OSV
Nov 4, 2026	references	CVE List
Nov 4, 2026	references	OSV
Nov 4, 2026	facts, references	GitHub Advisories
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-39892 is a medium vulnerability (CVSS 6.9) in Cryptography.io Cryptography, published April 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in cryptography 46.0.7.

References

Show 168 moreShow less