{"id":"CVE-2026-39892","aliases":["ALPINE-CVE-2026-39892","BELL-CVE-2026-39892","CLSA-2026-1778028237","DEBIAN-CVE-2026-39892","EUVD-2026-20640","GHSA-p423-j2cm-9vmq","PYSEC-2026-36","RHSA-2026:24761","RHSA-2026:24762","RHSA-2026:7295","ROOT-APP-PYPI-CVE-2026-39892","openSUSE-SU-2026:10535-1"],"status":"published","title":"cryptography has a buffer overflow if non-contiguous buffers were passed to APIs","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00677,"percentile":0.52573,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-131"],"published":"2026-04-08T19:23:08Z","modified":"2026-11-05T03:31:27Z","fixes":[{"ecosystem":"PyPI","package":"cryptography","fixed_in":["46.0.7"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-cryptography","fixed_in":["46.0.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-cryptography","fixed_in":["46.0.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-cryptography","fixed_in":["46.0.7-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"cryptography","fixed_in":["45.0.7.post2+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-cryptography","fixed_in":["46.0.7-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"cryptography","fixed_in":["46.0.6+aikido.5","46.0.5+aikido.7","46.0.3+aikido.8","46.0.4+aikido.5","45.0.7+aikido.5","45.0.5+aikido.9","46.0.1+aikido.6","46.0.1+aikido.1","46.0.1+aikido.2","46.0.6+aikido.1","46.0.3+aikido.9","46.0.5+aikido.3","45.0.5+aikido.5","46.0.1+aikido.3","46.0.4+aikido.3","46.0.3+aikido.4","46.0.6+aikido.2","45.0.7+aikido.1","45.0.7+aikido.2","46.0.4+aikido.4","46.0.5+aikido.4","45.0.7+aikido.3","46.0.1+aikido.4","46.0.3+aikido.5","46.0.6+aikido.3","45.0.5+aikido.6","46.0.5+aikido.5","45.0.5+aikido.7","45.0.5+aikido.8","46.0.5+aikido.6","45.0.7+aikido.4","46.0.3+aikido.6","46.0.3+aikido.7","46.0.1+aikido.5","46.0.6+aikido.4","45.0.5+aikido.10","45.0.7+aikido.6","46.0.1+aikido.7","46.0.5+aikido.8","46.0.6+aikido.6","46.0.4+aikido.6","46.0.3+aikido.10","46.0.4+aikido.7"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-cryptography","fixed_in":["46.0.7-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"45.0.0"},{"fixed":"46.0.7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"45.0.0"},{"fixed":"46.0.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"45.0.0"},{"fixed":"46.0.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"39.0.2-r0"},{"fixed":"46.0.7-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"45.0.7"},{"fixed":"45.0.7.post2+tuxcare"}]}],"versions":["45.0.7","45.0.7.post1+tuxcare"]},{"source":"osv","ecosystem":"Debian:14","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"46.0.7-1"}]}],"versions":["43.0.0-3","44.0.2-1","44.0.2-2","45.0.6-1","45.0.6-1~exp1","45.0.7-1","46.0.1-1","46.0.1-1~exp1","46.0.5-1","46.0.5-2","46.0.6-1"]},{"source":"osv","ecosystem":"PyPI","package":"cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"45.0.0"},{"fixed":"46.0.7"}]}],"versions":["45.0.0","45.0.1","45.0.2","45.0.3","45.0.4","45.0.5","45.0.6","45.0.7","46.0.0","46.0.1","46.0.2","46.0.3","46.0.4","46.0.5","46.0.6"]},{"source":"osv","ecosystem":"PyPI","package":"cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"45.0.0"},{"fixed":"46.0.7"}]}],"versions":["45.0.0","45.0.1","45.0.2","45.0.3","45.0.4","45.0.5","45.0.6","45.0.7","46.0.0","46.0.1","46.0.2","46.0.3","46.0.4","46.0.5","46.0.6"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-3.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-3.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.29-2.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.29-2.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-6.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-3.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.9-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python3-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python3-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-3.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-3.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-3.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-3.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"python3.12-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"python3.12-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:PyPI","package":"cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"46.0.6+aikido.5"},{"fixed":"46.0.5+aikido.7"},{"fixed":"46.0.3+aikido.8"},{"fixed":"46.0.4+aikido.5"},{"fixed":"45.0.7+aikido.5"},{"fixed":"45.0.5+aikido.9"},{"fixed":"46.0.1+aikido.6"},{"fixed":"46.0.1+aikido.1"},{"fixed":"46.0.1+aikido.2"},{"fixed":"46.0.6+aikido.1"},{"fixed":"46.0.3+aikido.9"},{"fixed":"46.0.5+aikido.3"},{"fixed":"45.0.5+aikido.5"},{"fixed":"46.0.1+aikido.3"},{"fixed":"46.0.4+aikido.3"},{"fixed":"46.0.3+aikido.4"},{"fixed":"46.0.6+aikido.2"},{"fixed":"45.0.7+aikido.1"},{"fixed":"45.0.7+aikido.2"},{"fixed":"46.0.4+aikido.4"},{"fixed":"46.0.5+aikido.4"},{"fixed":"45.0.7+aikido.3"},{"fixed":"46.0.1+aikido.4"},{"fixed":"46.0.3+aikido.5"},{"fixed":"46.0.6+aikido.3"},{"fixed":"45.0.5+aikido.6"},{"fixed":"46.0.5+aikido.5"},{"fixed":"45.0.5+aikido.7"},{"fixed":"45.0.5+aikido.8"},{"fixed":"46.0.5+aikido.6"},{"fixed":"45.0.7+aikido.4"},{"fixed":"46.0.3+aikido.6"},{"fixed":"46.0.3+aikido.7"},{"fixed":"46.0.1+aikido.5"},{"fixed":"46.0.6+aikido.4"},{"fixed":"45.0.5+aikido.10"},{"fixed":"45.0.7+aikido.6"},{"fixed":"46.0.1+aikido.7"},{"fixed":"46.0.5+aikido.8"},{"fixed":"46.0.6+aikido.6"},{"fixed":"46.0.4+aikido.6"},{"fixed":"46.0.3+aikido.10"},{"fixed":"46.0.4+aikido.7"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"46.0.7-1.1"}]}]}],"products":[{"vendor":"cryptography.io","product":"cryptography"},{"vendor":"pyca","product":"cryptography"},{"vendor":"red hat","product":"lightspeed core"},{"vendor":"red hat","product":"migration toolkit for applications 8"},{"vendor":"red hat","product":"openshift lightspeed"},{"vendor":"red hat","product":"red hat ai inference server"},{"vendor":"red hat","product":"red hat ai inference server 3.3"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 8"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 9"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6 for rhel 9"},{"vendor":"red hat","product":"red hat ansible automation platform ansible core 2"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat enterprise linux ai 3.3"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"red hat","product":"red hat quay 3"},{"vendor":"red hat","product":"red hat quay 3.10"},{"vendor":"red hat","product":"red hat quay 3.12"},{"vendor":"red hat","product":"red hat quay 3.14"},{"vendor":"red hat","product":"red hat quay 3.15"},{"vendor":"red hat","product":"red hat quay 3.16"},{"vendor":"red hat","product":"red hat quay 3.17"},{"vendor":"red hat","product":"red hat quay 3.9"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.4"}],"references":[{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","article"]},{"url":"https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5","tags":["x_refsource_MISC","fix","web","article"]},{"url":"https://github.com/pyca/cryptography/commit/c09d38ae52de7d95fe683b7a7c496f5751616f27","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-36.yaml","tags":["x_refsource_MISC","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/08/12","tags":["Mailing List","Release Notes","Third Party Advisory","web","advisory","article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39892","tags":["vdb-entry","x_refsource_REDHAT","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456735","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39892.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24761","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24762","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30089","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20338","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43855","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43854","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43851","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43670","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43853","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43651","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:46956","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7295","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22840","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22629","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21017","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24853","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22465","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23361","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24483","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39892","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p423-j2cm-9vmq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-39892","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-39892","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39892.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-39892","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452458","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464121","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24761.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-62718","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-62718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62718","tags":["advisory"]},{"url":"https://datatracker.ietf.org/doc/html/rfc1034#section-3.1","tags":["article"]},{"url":"https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2","tags":["article"]},{"url":"https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df","tags":["article"]},{"url":"https://github.com/axios/axios/pull/10661","tags":["article"]},{"url":"https://github.com/axios/axios/releases/tag/v1.15.0","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4926","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4926","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7246","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7246","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7246","tags":["advisory"]},{"url":"https://github.com/pallets/click/releases/tag/8.3.3","tags":["article"]},{"url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26996","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","tags":["article"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-30922","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-30922","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30922","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32280","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","tags":["advisory"]},{"url":"https://go.dev/cl/758320","tags":["article"]},{"url":"https://go.dev/issue/78282","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4947","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32282","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","tags":["advisory"]},{"url":"https://go.dev/cl/763761","tags":["article"]},{"url":"https://go.dev/issue/78293","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4864","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283","tags":["advisory"]},{"url":"https://go.dev/cl/763767","tags":["article"]},{"url":"https://go.dev/issue/78334","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4870","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33891","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33891","tags":["advisory"]},{"url":"https://github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023","tags":["article"]},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33894","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33894","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33894","tags":["advisory"]},{"url":"https://datatracker.ietf.org/doc/html/rfc2313#section-8","tags":["article"]},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp","tags":["article"]},{"url":"https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc8017.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33895","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33895","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33895","tags":["advisory"]},{"url":"https://datatracker.ietf.org/doc/html/rfc8032#section-8.4","tags":["article"]},{"url":"https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85","tags":["article"]},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33896","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33896","tags":["advisory"]},{"url":"https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90","tags":["article"]},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39363","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39363","tags":["advisory"]},{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39892","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40192","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/pull/9521","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j","tags":["article"]},{"url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457432","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24762.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40175","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40175","tags":["advisory"]},{"url":"https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1","tags":["article"]},{"url":"https://github.com/axios/axios/pull/10660","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26007","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34073","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7295.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2438762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26007","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453276","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34073","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34073","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43","tags":["article"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39892","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-39892","title":"cryptography has a buffer overflow if non-contiguous buffers were passed to APIs","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.","status":"published","published":"2026-04-08T20:49:41.967Z","modified":"2026-11-04T03:18:10.286Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-119","CWE-131"],"updated_at":"2026-11-04T04:50:53.041166Z"}],"euvd":[{"id":"EUVD-2026-20640","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.","status":"published","published":"2026-04-08T20:49:41Z","modified":"2026-11-04T03:18:10Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-04T04:58:07.231207Z"}],"ghsa":[{"id":"GHSA-p423-j2cm-9vmq","title":"Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs","description":"If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. `Hash.update()`), this could lead to buffer overflows. For example:\n\n```python\nh = Hash(SHA256())\nb.update(buf[::-1])\n```\n\nwould read past the end of the buffer on Python \u003e3.11","status":"published","published":"2026-04-08T19:23:08Z","modified":"2026-11-04T03:16:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-119","CWE-131"],"updated_at":"2026-11-04T03:22:00.099882Z"}],"nvd":[{"id":"CVE-2026-39892","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.","status":"published","published":"2026-04-08T21:17:01.547Z","modified":"2026-11-04T04:17:35.227Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-131"],"updated_at":"2026-11-04T06:53:16.37612Z"}],"osv":[{"id":"ALPINE-CVE-2026-39892","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.","status":"published","published":"2026-04-08T21:17:01.547Z","modified":"2026-10-01T02:17:49.271506965Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-39892","status":"published","published":"2026-04-10T06:09:37.190934Z","modified":"2026-04-25T07:22:32.631194Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-39892","title":"cryptography has a buffer overflow if non-contiguous buffers were passed to APIs","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.","status":"published","published":"2026-04-08T20:49:41.967Z","modified":"2026-11-05T03:31:27.184227236Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-05T07:12:28.867005Z"},{"id":"DEBIAN-CVE-2026-39892","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.","status":"published","published":"2026-04-08T21:17:01.547Z","modified":"2026-11-04T09:47:36.803874231Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T10:05:32.187009Z"},{"id":"GHSA-p423-j2cm-9vmq","title":"Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs","description":"If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. `Hash.update()`), this could lead to buffer overflows. For example:\n\n```python\nh = Hash(SHA256())\nb.update(buf[::-1])\n```\n\nwould read past the end of the buffer on Python \u003e3.11","status":"published","published":"2026-04-08T19:23:08Z","modified":"2026-11-04T03:30:50.401534783Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-119","CWE-131"],"updated_at":"2026-11-04T03:56:18.279609Z"},{"id":"PYSEC-2026-36","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.","status":"published","published":"2026-04-08T21:17:01.547Z","modified":"2026-05-20T09:18:55.965312Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"RHSA-2026:24761","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-06-10T10:07:59Z","modified":"2026-10-20T10:06:29Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:24762","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-06-10T10:08:00Z","modified":"2026-10-20T10:06:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:7295","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:09Z","modified":"2026-10-20T10:15:12Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"ROOT-APP-PYPI-CVE-2026-39892","title":"CVE-2026-39892 in cryptography - Patched by Root","description":"Root has patched CVE-2026-39892 in the cryptography package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-30T11:16:52Z","modified":"2026-10-30T12:17:11.265444737Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"CLSA-2026-1778028237","title":"TuxCare security update for cryptography (1 CVE)","description":"TuxCare rebuilt cryptography to address 1 CVE. Fixed in 45.0.7.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:48:04.971323429Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"openSUSE-SU-2026:10535-1","title":"python311-cryptography-46.0.7-1.1 on GA media","description":"These are all security issues fixed in the python311-cryptography-46.0.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-11T00:00:00Z","modified":"2026-04-12T10:18:33.954587Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}