CVE-2026-39892

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Database specific

{
    "cwe_ids": [
        "CWE-119"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39892.json"
}

References

Affected packages

Git / github.com/pyca/cryptography

Affected ranges

Type

GIT

Repo

https://github.com/pyca/cryptography

Events

Introduced

67840977c95a23d0dcfba154e303014026df0d3e

Fixed

622d672e429a7cff836a23c5903683dbec1901f5

Database specific

{
    "extracted_events": [
        {
            "introduced": "45.0.0"
        },
        {
            "fixed": "46.0.7"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

45.*

45.0.0

46.*

46.0.0

46.0.1

46.0.2

46.0.3

46.0.4

46.0.5

46.0.6

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-39892.json"