CVE catalog

CVE-2026-39892

Severity: High · CVSS 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published: Apr 8, 2026, 7:23:08 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.65% · Oct 25, 2026

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	python-cryptography	sid	`49.0.0-2`	fixed
Debian	python-cryptography	forky	`49.0.0-2`	fixed
Debian	python-cryptography	trixie	`43.0.0-3+deb13u1`	not affected
Debian	python-cryptography	bookworm	`38.0.4-3+deb12u1`	not affected
Debian	python-cryptography	bookworm-security	`38.0.4-3~deb12u1`	not affected
Cpe	cryptography	Not reported	`46.0.7`	fixed
PyPI	cryptography	Not reported	`46.0.7`	fixed
Cpe	cryptography	Not reported	`46.0.7`	fixed
Alpine	py3-cryptography	3.23	`46.0.7-r0`	fixed
Alpine	py3-cryptography	3.24	`46.0.7-r0`	fixed
Opensuse	python-cryptography	tumbleweed	`46.0.7-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	python-cryptography	source	sid	`46.0.7-1`	not yet assigned	Not reported	[1133076]
Debian	python-cryptography	source	forky	`46.0.7-1`	not yet assigned	Not reported	[1133076]
Debian	python-cryptography	source	trixie	`Not affected`	unimportant	Not reported	[1133076]
Debian	python-cryptography	source	bookworm	`Not affected`	unimportant	Not reported	[1133076]
Cpe	cryptography	cpe	Not reported	`46.0.7`	Not reported	Not reported	Not reported
PyPI	cryptography	PyPI	Not reported	`46.0.7`	Not reported	GHSA-P423-J2CM-9VMQ	Not reported
Cpe	cryptography	cpe	Not reported	`46.0.7`	Not reported	NVD-CVE-2026-39892	Not reported
Alpine	py3-cryptography	apk	3.23	`46.0.7-r0`	Not reported	ALPINE-CVE-2026-39892	Not reported
Alpine	py3-cryptography	apk	3.24	`46.0.7-r0`	Not reported	ALPINE-CVE-2026-39892	Not reported
Opensuse	python-cryptography	rpm	tumbleweed	`46.0.7-1.1`	Not reported	OPENSUSE-SU-2026:10535-1	Not reported

[Debian bug #1133076]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[python313-cryptography]Unknown
Source package: [python-cryptography]
Details (1)
- 50.0.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 46.0.7-1.1
  Version impact unknown
  nvd · python-cryptography · opensuse · tumbleweed
[python314-cryptography]Unknown
Source package: [python-cryptography]
Details (1)
- 50.0.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 46.0.7-1.1
  Version impact unknown
  nvd · python-cryptography · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[python3-cryptography]Not affected
Source package: [python-cryptography]
Details (4)
- 38.0.4-3+deb12u1 · amd64 · bookworm
  Not affected
  nvd · python-cryptography · debian · bookworm
- 38.0.4-3+deb12u1 · arm64 · bookworm
  Not affected
  nvd · python-cryptography · debian · bookworm
- 38.0.4-3~deb12u1 · amd64 · bookworm-security
  Not affected
  nvd · python-cryptography · debian · bookworm
- 38.0.4-3~deb12u1 · arm64 · bookworm-security
  Not affected
  nvd · python-cryptography · debian · bookworm
[python-cryptography-doc]Not affected
Source package: [python-cryptography]
Details (2)
- 38.0.4-3+deb12u1 · all · bookworm
  Not affected
  nvd · python-cryptography · debian · bookworm
- 38.0.4-3+deb12u1 · all · bookworm
  Not affected
  nvd · python-cryptography · debian · bookworm

Observed: Oct 23, 2026, 10:34:53 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]