CVE-2026-39892

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39892
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-39892.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-39892
Aliases
Downstream
Related
Published
2026-04-08T20:49:41.967Z
Modified
2026-06-18T03:56:11.502059901Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-119"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39892.json"
}
References

Affected packages

Git / github.com/pyca/cryptography

Affected ranges

Type
GIT
Repo
https://github.com/pyca/cryptography
Events
Introduced
67840977c95a23d0dcfba154e303014026df0d3e
Fixed
622d672e429a7cff836a23c5903683dbec1901f5
Database specific 
{
    "cpe": "cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "45.0.0"
        },
        {
            "fixed": "46.0.7"
        },
        {
            "introduced": "45.0.0"
        },
        {
            "fixed": "46.0.7"
        }
    ]
}

Affected versions

45.*
45.0.0
46.*
46.0.0
46.0.1
46.0.2
46.0.3
46.0.4
46.0.5
46.0.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-39892.json"