Read the docs
TI-2024-17221 Aliases CVE-2024-26130GHSA-6vqw-3v5j-54x4

NULL pointer dereference in pyca cryptography

Priority MEDIUM 40CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-476.

Summary

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00831 57th percentileScored 2026-11-07
Fix Fixed cryptography (pyca): 42.0.4cryptography (PyPI): 42.0.4Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pycacryptography38.0.0 to before 42.0.442.0.4Patch availableCNA
—cryptography (PyPI)38.0.0 to before 42.0.442.0.4Patch availableGHSA-6vqw-3v5j-54x4
  • cryptography Vendorpyca Affected 38.0.0 to before 42.0.4 Fixed in 42.0.4 Patch available CNA
  • cryptography (PyPI) Vendor— Affected 38.0.0 to before 42.0.4 Fixed in 42.0.4 Patch available GHSA-6vqw-3v5j-54x4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:*38.0.0 to before 42.0.4VulnerableCryptography.io
  • cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:* Versions 38.0.0 to before 42.0.4 Vulnerable ·Cryptography.io

Remediation

  • Fix · CNA cryptography (pyca) Fixed in 42.0.4
  • Fix · GHSA-6vqw-3v5j-54x4 cryptography (PyPI) Fixed in 42.0.4 Advisory →

Red Hat 4 advisories

  • RHSA-2025:15608 Released 2025-09-10 · Red Hat rating Important
    python3.12-cryptography security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-cryptography-41.0.7-2.el9_6.1
  • RHSA-2025:1335 Released 2025-02-12 · Red Hat rating Important
    RHUI 4.11 security, bugfix, and enhancement update
    • RHUI 4 for RHEL 8 python-aiohttp-3.9.4-1.el8ui, python-cryptography-42.0.8-1.el8ui, python-django-4.2.15-1.el8ui +13
  • RHSA-2024:7987 Released 2024-10-10 · Red Hat rating Moderate
    Satellite 6.15.4 Security Update
    • Red Hat Satellite 6.15 for RHEL 8 python-cryptography-42.0.8-1.el8pc, python-django-4.2.15-1.el8pc, python-gunicorn-22.0.0-1.el8pc +5
Show 1 more Red Hat advisories
  • RHSA-2024:3781 Released 2024-06-10 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.7-1.el8ap, automation-hub-4.9.2-1.el8ap, python39-aiohttp-3.9.5-1.el8ap +25
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.7-1.el9ap, automation-hub-4.9.2-1.el9ap, python-aiohttp-3.9.5-1.el9ap +25

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHUI 4 for RHEL 8Fixed RHSA-2025:1335
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2024:3781
Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed RHSA-2024:3781
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:15608
Red Hat Satellite 6.15 for RHEL 8Fixed RHSA-2024:7987
Not affected: 7 products
  • RHUI 4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Satellite 6.15 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-26130
  2. 2026-10-03 Alias added: GHSA-6vqw-3v5j-54x4

References

Patch 2

Advisory 2

Other 2

  • TI-2026-48588 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVSS 4.0HIGH 8.7
  • TI-2026-48587 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees CVSS 4.0MEDIUM 6.9
  • TI-2026-48586 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences