CVE catalog
CVE-2026-26007
python-cryptography vulnerability
- Severity
- High · CVSS 8.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.39% · Oct 25, 2026
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-cryptography | sid | 49.0.0-2 | fixed |
| Debian | python-cryptography | forky | 49.0.0-2 | fixed |
| Debian | python-cryptography | trixie | 43.0.0-3+deb13u1 | fixed |
| Debian | python-cryptography | bookworm | 38.0.4-3+deb12u1 | vulnerable |
| Debian | python-cryptography | bookworm-security | 38.0.4-3~deb12u1 | vulnerable |
| Ubuntu | python-cryptography | noble | Not reported | vulnerable |
| Ubuntu | python-cryptography | noble | 41.0.7-4ubuntu0.3 | fixed |
| Ubuntu | python-cryptography-doc | noble | 41.0.7-4ubuntu0.3 | fixed |
| Ubuntu | python3-cryptography | noble | 41.0.7-4ubuntu0.3 | fixed |
| PyPI | cryptography | Not reported | 46.0.5 | fixed |
| Cpe | cryptography | Not reported | 46.0.5 | fixed |
| Alpine | py3-cryptography | 3.23 | 46.0.5-r0 | fixed |
| Alpine | py3-cryptography | 3.24 | 46.0.5-r0 | fixed |
| Ubuntu | python-cryptography | pro | 2.6.1-3.1 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.6.1-4 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.6.1-4ubuntu1 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-1ubuntu2 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-2 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-3 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-3ubuntu0.1 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-3ubuntu0.2 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-3ubuntu0.3 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-3ubuntu0.3+esm2 | fixed |
| Ubuntu | python-cryptography | 22.04 | 3.3.2-1 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.3.2-1build1 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1ubuntu1 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1ubuntu2 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1ubuntu2.1 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1ubuntu2.2 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1ubuntu2.3 | fixed |
| Ubuntu | python-cryptography | 24.04 | 38.0.4-4 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 38.0.4-4ubuntu1 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 41.0.7-3 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 41.0.7-4build2 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 41.0.7-4build3 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 41.0.7-4ubuntu0.1 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 41.0.7-4ubuntu0.3 | fixed |
| Ubuntu | python-cryptography | 25.10 | 43.0.0-1ubuntu1 | vulnerable |
| Ubuntu | python-cryptography | 25.10 | 43.0.0-1ubuntu1.1 | fixed |
| Ubuntu | python-cryptography | pro | 2.6.1-3.1 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.6.1-4 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.6.1-4ubuntu1 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-1ubuntu2 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-2 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-3 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-3ubuntu0.1 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-3ubuntu0.2 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-3ubuntu0.3 | vulnerable |
| Ubuntu | python-cryptography | pro | 2.8-3ubuntu0.3+esm2 | fixed |
| Ubuntu | python-cryptography | 22.04 | 3.3.2-1 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.3.2-1build1 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1ubuntu1 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1ubuntu2 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1ubuntu2.1 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1ubuntu2.2 | vulnerable |
| Ubuntu | python-cryptography | 22.04 | 3.4.8-1ubuntu2.3 | fixed |
| Ubuntu | python-cryptography | 24.04 | 38.0.4-4 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 38.0.4-4ubuntu1 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 41.0.7-3 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 41.0.7-4build2 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 41.0.7-4build3 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 41.0.7-4ubuntu0.1 | vulnerable |
| Ubuntu | python-cryptography | 24.04 | 41.0.7-4ubuntu0.3 | fixed |
| Ubuntu | python-cryptography | 25.10 | 43.0.0-1ubuntu1 | vulnerable |
| Ubuntu | python-cryptography | 25.10 | 43.0.0-1ubuntu1.1 | fixed |
| Opensuse | python-cryptography | leap 16.0 | 44.0.3-160000.3.1 | fixed |
| Suse | python-cryptography | linux enterprise server 16.0 | 44.0.3-160000.3.1 | fixed |
| Suse | python-cryptography | linux enterprise server for sap applications 16.0 | 44.0.3-160000.3.1 | fixed |
| Suse | python-cryptography | linux micro 6.2 | 44.0.3-160000.3.1 | fixed |
| Opensuse | python-cryptography | tumbleweed | 46.0.5-1.1 | fixed |
| Suse | python-cryptography | linux micro 6.0 | 42.0.4-3.1 | fixed |
| Suse | python-cryptography | linux micro 6.1 | 42.0.4-slfo.1.1_3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-cryptography | source | sid | 46.0.5-1 | not yet assigned | Not reported | [1127926] |
| Debian | python-cryptography | source | forky | 46.0.5-1 | not yet assigned | Not reported | [1127926] |
| Debian | python-cryptography | source | trixie | 43.0.0-3+deb13u1 | not yet assigned | Not reported | [1127926] |
| Debian | python-cryptography | source | bookworm | (unfixed) | not yet assigned | Not reported | [1127926] |
| Ubuntu | python-cryptography | deb | noble | 41.0.7-4ubuntu0.3 | Not reported | Not reported | Not reported |
| Ubuntu | python-cryptography-doc | deb | noble | 41.0.7-4ubuntu0.3 | Not reported | Not reported | Not reported |
| Ubuntu | python3-cryptography | deb | noble | 41.0.7-4ubuntu0.3 | Not reported | Not reported | Not reported |
| PyPI | cryptography | PyPI | Not reported | 46.0.5 | Not reported | GHSA-R6PH-V2QM-Q3C2 | Not reported |
| Cpe | cryptography | cpe | Not reported | 46.0.5 | Not reported | NVD-CVE-2026-26007 | Not reported |
| Alpine | py3-cryptography | apk | 3.23 | 46.0.5-r0 | Not reported | ALPINE-CVE-2026-26007 | Not reported |
| Alpine | py3-cryptography | apk | 3.24 | 46.0.5-r0 | Not reported | ALPINE-CVE-2026-26007 | Not reported |
| Ubuntu | python-cryptography | deb | pro | 2.8-3ubuntu0.3+esm2 | Not reported | USN-8087-3 | Not reported |
| Ubuntu | python-cryptography | deb | 22.04 | 3.4.8-1ubuntu2.3 | Not reported | USN-8087-1 | Not reported |
| Ubuntu | python-cryptography | deb | 24.04 | 41.0.7-4ubuntu0.3 | Not reported | USN-8087-1 | Not reported |
| Ubuntu | python-cryptography | deb | 25.10 | 43.0.0-1ubuntu1.1 | Not reported | USN-8087-1 | Not reported |
| Ubuntu | python-cryptography | deb | pro | 2.8-3ubuntu0.3+esm2 | Not reported | UBUNTU-CVE-2026-26007 | Not reported |
| Ubuntu | python-cryptography | deb | 22.04 | 3.4.8-1ubuntu2.3 | Not reported | UBUNTU-CVE-2026-26007 | Not reported |
| Ubuntu | python-cryptography | deb | 24.04 | 41.0.7-4ubuntu0.3 | Not reported | UBUNTU-CVE-2026-26007 | Not reported |
| Ubuntu | python-cryptography | deb | 25.10 | 43.0.0-1ubuntu1.1 | Not reported | UBUNTU-CVE-2026-26007 | Not reported |
| Opensuse | python-cryptography | rpm | leap 16.0 | 44.0.3-160000.3.1 | Not reported | OPENSUSE-SU-2026:20506-1 | Not reported |
| Suse | python-cryptography | rpm | linux enterprise server 16.0 | 44.0.3-160000.3.1 | Not reported | SUSE-SU-2026:21165-1 | Not reported |
| Suse | python-cryptography | rpm | linux enterprise server for sap applications 16.0 | 44.0.3-160000.3.1 | Not reported | SUSE-SU-2026:21165-1 | Not reported |
| Suse | python-cryptography | rpm | linux micro 6.2 | 44.0.3-160000.3.1 | Not reported | SUSE-SU-2026:21021-1 | Not reported |
| Opensuse | python-cryptography | rpm | tumbleweed | 46.0.5-1.1 | Not reported | OPENSUSE-SU-2026:10205-1 | Not reported |
| Suse | python-cryptography | rpm | linux micro 6.0 | 42.0.4-3.1 | Not reported | SUSE-SU-2026:20706-1 | Not reported |
| Suse | python-cryptography | rpm | linux micro 6.1 | 42.0.4-slfo.1.1_3.1 | Not reported | SUSE-SU-2026:20655-1 | Not reported |
Notes
[bookworm] python-cryptography: Minor issue; only affects binary elliptic curves, which are rarely used in real-world applications
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-cryptography]Affected
Source package: [python-cryptography]
Details (4)
38.0.4-3+deb12u1· amd64 · bookwormAffected
usn · python-cryptography · debian · bookworm; usn · python-cryptography · debian · 12
38.0.4-3+deb12u1· arm64 · bookwormAffected
usn · python-cryptography · debian · bookworm; usn · python-cryptography · debian · 12
38.0.4-3~deb12u1· amd64 · bookworm-securityAffected
usn · python-cryptography · debian · bookworm; usn · python-cryptography · debian · 12
38.0.4-3~deb12u1· arm64 · bookworm-securityAffected
usn · python-cryptography · debian · bookworm; usn · python-cryptography · debian · 12
- [python-cryptography-doc]Affected
Source package: [python-cryptography]
Details (2)
38.0.4-3+deb12u1· all · bookwormAffected
usn · python-cryptography · debian · bookworm; usn · python-cryptography · debian · 12
38.0.4-3+deb12u1· all · bookwormAffected
usn · python-cryptography · debian · bookworm; usn · python-cryptography · debian · 12
[openSUSE Tumbleweed]
- [python313-cryptography]Unknown
Source package: [python-cryptography]
Details (1)
50.0.0-1.1· x86_64 · tumbleweedUnknown · Fixed:
46.0.5-1.1Version impact unknown
usn · python-cryptography · opensuse · tumbleweed
- [python314-cryptography]Unknown
Source package: [python-cryptography]
Details (1)
50.0.0-1.1· x86_64 · tumbleweedUnknown · Fixed:
46.0.5-1.1Version impact unknown
usn · python-cryptography · opensuse · tumbleweed
[Debian 13 (Trixie)]
- [python3-cryptography]Fixed
Source package: [python-cryptography]
Details (2)
43.0.0-3+deb13u1· amd64 · trixieFixed · Fixed:
43.0.0-3+deb13u1usn · python-cryptography · debian · 13
43.0.0-3+deb13u1· arm64 · trixieFixed · Fixed:
43.0.0-3+deb13u1usn · python-cryptography · debian · 13
- [python-cryptography-doc]Fixed
Source package: [python-cryptography]
Details (2)
43.0.0-3+deb13u1· all · trixieFixed · Fixed:
43.0.0-3+deb13u1usn · python-cryptography · debian · 13
43.0.0-3+deb13u1· all · trixieFixed · Fixed:
43.0.0-3+deb13u1usn · python-cryptography · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-26007]
- [https://osv.dev/vulnerability/ALPINE-CVE-2026-26007]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-26007]
- [https://osv.dev/vulnerability/GHSA-r6ph-v2qm-q3c2]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20655-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:20706-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:21021-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:21165-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-26007]
- [https://osv.dev/vulnerability/USN-8087-1]
- [https://osv.dev/vulnerability/USN-8087-3]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10205-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:20506-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-26007]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26007.json]
- [https://ubuntu.com/security/notices/USN-8087-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1194.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]