GHSA-537c-gmf6-5ccf
Vulnerable OpenSSL included in cryptography wheels
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score used
Vulnerable OpenSSL included in cryptography wheels
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
- Record
GHSA-537c-gmf6-5ccf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125, CWE-1395
- Updated
- 2026-11-02
OSV
Vulnerable OpenSSL included in cryptography wheels
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.
If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
- Record
GHSA-537c-gmf6-5ccf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125, CWE-1395
- Updated
- 2026-11-02
OSVCLSA-2026-1782435539No score
TuxCare security update for cryptography (1 CVE)
TuxCare rebuilt cryptography to address 1 CVE. Fixed in 46.0.7.post1+tuxcare.
- Record
CLSA-2026-1782435539- Updated
- 2026-11-02
OSVCLSA-2026-1782694757No score
TuxCare security update for cryptography (1 CVE)
TuxCare rebuilt cryptography to address 1 CVE. Fixed in 44.0.3.post2+tuxcare.
- Record
CLSA-2026-1782694757- Updated
- 2026-11-02
OSVCLSA-2026-1790239456No score
TuxCare security update for cryptography (1 CVE)
TuxCare rebuilt cryptography to address 1 CVE. Fixed in 43.0.3.post5+tuxcare.
- Record
CLSA-2026-1790239456- Updated
- 2026-11-02
OSVCLSA-2026-1790246772No score
TuxCare security update for cryptography (1 CVE)
TuxCare rebuilt cryptography to address 1 CVE. Fixed in 41.0.7.post3+tuxcare.
- Record
CLSA-2026-1790246772- Updated
- 2026-11-02
OSVCLSA-2026-1790246901No score
TuxCare security update for cryptography (1 CVE)
TuxCare rebuilt cryptography to address 1 CVE. Fixed in 43.0.1.post4+tuxcare.
- Record
CLSA-2026-1790246901- Updated
- 2026-11-02
OSVCLSA-2026-1790247608No score
TuxCare security update for cryptography (1 CVE)
TuxCare rebuilt cryptography to address 1 CVE. Fixed in 42.0.8.post4+tuxcare.
- Record
CLSA-2026-1790247608- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cryptographyPyPI | 0.5.0 up to 48.0.1 | 48.0.1 |
cryptographyTuxCare:PyPI | 46.0.7 up to 46.0.7.post1+tuxcare | 46.0.7.post1+tuxcare |
cryptographyTuxCare:PyPI | 44.0.3 up to 44.0.3.post2+tuxcare, plus listed versions 44.0.3.post1+tuxcare | 44.0.3.post2+tuxcare |
cryptographyTuxCare:PyPI | 43.0.3 up to 43.0.3.post5+tuxcare, plus listed versions 43.0.3.post1+tuxcare43.0.3.post2+tuxcare43.0.3.post3+tuxcare43.0.3.post4+tuxcare | 43.0.3.post5+tuxcare |
cryptographyTuxCare:PyPI | 41.0.7 up to 41.0.7.post3+tuxcare, plus listed versions 41.0.7.post1+tuxcare41.0.7.post2+tuxcare | 41.0.7.post3+tuxcare |
cryptographyTuxCare:PyPI | 43.0.1 up to 43.0.1.post4+tuxcare, plus listed versions 43.0.1.post1+tuxcare43.0.1.post2+tuxcare43.0.1.post3+tuxcare | 43.0.1.post4+tuxcare |
cryptographyTuxCare:PyPI | 42.0.8 up to 42.0.8.post4+tuxcare, plus listed versions 42.0.8.post1+tuxcare42.0.8.post2+tuxcare42.0.8.post3+tuxcare | 42.0.8.post4+tuxcare |
cryptographyPyPI | 0.5.0 up to 48.0.1, plus listed versions 0.50.5.10.5.20.5.30.5.4 Show 45 moreShow less0.60.6.10.70.7.10.7.20.80.8.10.8.20.90.9.10.9.20.9.31.01.0.11.0.21.11.1.11.1.21.21.2.11.2.21.2.31.31.3.11.3.21.3.31.3.41.41.51.5.11.5.21.5.31.61.71.7.11.7.21.81.8.11.8.21.92.02.0.12.0.22.0.32.1 | 48.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts | ||
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-537c-gmf6-5ccf is a high vulnerability (CVSS 7.5) in cryptography, published June 15, 2026. No source lists public exploit code. Fixed in cryptography 48.0.1.
References
Left out here: 99 versions. The JSON record has them.