Skip to content
Heist/ feed
Back to feed
Medium

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

Type: advisorySources: OSV

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-39892
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 02:16 UTC · Revision 1

Source evidence

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

core-osv · Original source

Published 8 Apr 2026, 20:49 UTC

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

osv:CVE-2026-39892
Complete source record
{
  "id": "8a6198e6e17b8fc42a4f2a36391ebec8536ff8c6d911e25ce215737ec7f57e0f",
  "url": "https://osv.dev/vulnerability/CVE-2026-39892",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "cryptography has a buffer overflow if non-contiguous buffers were passed to APIs",
    "summary": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.",
    "evidence": "osv:CVE-2026-39892",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-39892",
      "aliases": [
        "CVE-2026-39892",
        "GHSA-p423-j2cm-9vmq",
        "PYSEC-2026-36"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/pyca/cryptography",
              "type": "GIT",
              "events": [
                {
                  "introduced": "67840977c95a23d0dcfba154e303014026df0d3e"
                },
                {
                  "fixed": "622d672e429a7cff836a23c5903683dbec1901f5"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "45.0.0"
                      },
                      {
                        "fixed": "46.0.7"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "cpe": "cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:*",
                    "range": [
                      {
                        "introduced": "45.0.0"
                      },
                      {
                        "fixed": "46.0.7"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "46.0.6",
            "46.0.5",
            "46.0.4",
            "46.0.3",
            "46.0.2",
            "46.0.1",
            "46.0.0",
            "45.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39892.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:46.241589069Z",
      "provider": "osv",
      "references": [
        "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39892.json",
        "https://access.redhat.com/errata/RHSA-2026:19375",
        "https://access.redhat.com/errata/RHSA-2026:20338",
        "https://access.redhat.com/errata/RHSA-2026:21017",
        "https://access.redhat.com/errata/RHSA-2026:22465",
        "https://access.redhat.com/errata/RHSA-2026:22629",
        "https://access.redhat.com/errata/RHSA-2026:22840",
        "https://access.redhat.com/errata/RHSA-2026:23361",
        "https://access.redhat.com/errata/RHSA-2026:24483",
        "https://access.redhat.com/errata/RHSA-2026:24761",
        "https://access.redhat.com/errata/RHSA-2026:24762",
        "https://access.redhat.com/errata/RHSA-2026:24853",
        "https://access.redhat.com/errata/RHSA-2026:24866",
        "https://access.redhat.com/errata/RHSA-2026:24977",
        "https://access.redhat.com/errata/RHSA-2026:30088",
        "https://access.redhat.com/errata/RHSA-2026:30089",
        "https://access.redhat.com/errata/RHSA-2026:37275",
        "https://access.redhat.com/errata/RHSA-2026:42644",
        "https://access.redhat.com/errata/RHSA-2026:43651",
        "https://access.redhat.com/errata/RHSA-2026:43670",
        "https://access.redhat.com/errata/RHSA-2026:43851",
        "https://access.redhat.com/errata/RHSA-2026:43853",
        "https://access.redhat.com/errata/RHSA-2026:43854",
        "https://access.redhat.com/errata/RHSA-2026:43855",
        "https://access.redhat.com/errata/RHSA-2026:46956",
        "https://access.redhat.com/errata/RHSA-2026:7295",
        "https://access.redhat.com/security/cve/CVE-2026-39892",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39892.json",
        "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-39892",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2456735"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-119"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39892.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-39892",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 514207,
  "published_at": "2026-04-08T20:49:41.967+00:00"
}