cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
Priority LOW 38CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 18 fixed, 13 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00677 52nd percentileScored 2026-11-07
Fix Partial cryptography (pyca): 46.0.7cryptography (PyPI): 46.0.7Red Hat: 27 advisoriesRed Hat: 18 fixed, 13 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pyca | cryptography | 45.0.0 to before 46.0.7 | 46.0.7 | Patch available | CNA |
| — | cryptography (PyPI) | 45.0.0 to before 46.0.7 | 46.0.7 | Patch available | GHSA-p423-j2cm-9vmq |
- cryptography Vendorpyca Affected 45.0.0 to before 46.0.7 Fixed in 46.0.7 Patch available CNA
- cryptography (PyPI) Vendor— Affected 45.0.0 to before 46.0.7 Fixed in 46.0.7 Patch available GHSA-p423-j2cm-9vmq
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:* | 45.0.0 to before 46.0.7 | Vulnerable | Cryptography.io |
- cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:* Versions 45.0.0 to before 46.0.7 Vulnerable ·Cryptography.io
Remediation
- Fix · CNA cryptography (pyca) Fixed in 46.0.7
- Fix · GHSA-p423-j2cm-9vmq cryptography (PyPI) Fixed in 46.0.7 Advisory →
Red Hat 27 advisories
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:46956 Released 2026-07-27 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.5
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:43855 Released 2026-07-22 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.5
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9
Show 24 more Red Hat advisories
- RHSA-2026:43853 Released 2026-07-22 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.5
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9
- RHSA-2026:43854 Released 2026-07-22 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.5
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9
- RHSA-2026:43851 Released 2026-07-22 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.5
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9
- RHSA-2026:43670 Released 2026-07-22 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.5
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-cuda-rhel9
- RHSA-2026:43651 Released 2026-07-22 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.5
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-rocm-rhel9
- RHSA-2026:42644 Released 2026-07-21 · Red Hat rating ImportantRHOAI 2.25.9 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9 +36
- RHSA-2026:37275 Released 2026-07-09 · Red Hat rating CriticalRHOAI 3.3.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9, registry.redhat.io/rhoai/odh-feast-operator-rhel9 +45
- RHSA-2026:30089 Released 2026-06-25 · Red Hat rating CriticalRed Hat AI Inference Server 3.3.5 (CUDA)
- Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
- RHSA-2026:30088 Released 2026-06-25 · Red Hat rating CriticalRed Hat AI Inference Server 3.3.5 (ROCm)
- Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
- RHSA-2026:26068 Released 2026-06-15 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:24977 Released 2026-06-10 · Red Hat rating ImportantRHOAI 2.25.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +34
- RHSA-2026:24866 Released 2026-06-09 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9 +7
- RHSA-2026:24853 Released 2026-06-09 · Red Hat rating ImportantRed Hat Quay 3.15.5
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:24761 Released 2026-06-09 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.29-2.el8ap, automation-gateway-proxy-server-2.5.10-6.el8ap, automation-gateway-server-2.5.20260422-3.el8ap +4
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.29-2.el9ap, automation-gateway-proxy-server-2.6.14-3.el9ap, automation-gateway-server-2.5.20260422-3.el9ap +4
- RHSA-2026:24762 Released 2026-06-09 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 python3-click-8.3.3-1.el10ap, receptor-1.6.5-1.el10ap, receptorctl-1.6.5-1.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.12-1.el9ap, automation-controller-cli-4.7.12-1.el9ap, automation-controller-server-4.7.12-1.el9ap +10
- RHSA-2026:24483 Released 2026-06-08 · Red Hat rating ImportantRHTAS 1.4 - GA Release of Model Transparency 1.0.1
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-rhel9
- RHSA-2026:23361 Released 2026-06-04 · Red Hat rating ImportantRed Hat Quay 3.9.22
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:22840 Released 2026-06-03 · Red Hat rating ImportantRed Hat Quay 3.10.22
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:22629 Released 2026-06-02 · Red Hat rating ImportantRed Hat Quay 3.12.18
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:22465 Released 2026-06-02 · Red Hat rating ImportantRed Hat Quay 3.17.2
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:21017 Released 2026-05-26 · Red Hat rating ImportantRed Hat Quay 3.14.8
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:20338 Released 2026-05-21 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:19375 Released 2026-05-19 · Red Hat rating ImportantRed Hat Quay 3.16.4
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:7295 Released 2026-04-09 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images python-cryptography-46.0.7-1.hum1@src
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Lightspeed Core | Affected | No fix yet |
| Migration Toolkit for Applications 8 | Affected | No fix planned: Will not fix |
| Red Hat AI Inference Server | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform Ansible Core 2 | Affected | No fix yet |
| Red Hat Discovery 2 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Red Hat AI Inference Server 3.3 | Fixed | RHSA-2026:30088, RHSA-2026:30089 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:24866 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:24762 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:20338 |
| Red Hat Enterprise Linux AI 3.3 | Fixed | RHSA-2026:43651, RHSA-2026:43670, RHSA-2026:43851, RHSA-2026:43853, RHSA-2026:43854, RHSA-2026:43855, RHSA-2026:46956 |
| Red Hat Hardened Images | Fixed | RHSA-2026:7295 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:24977, RHSA-2026:42644, RHSA-2026:87410 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:37275 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:22840 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:22629 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:21017 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:24853 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:19375 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:22465 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:23361 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:24483 |
Not affected: 20 products
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Discovery 2
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.9
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-39892
- 2026-10-03 Alias added: GHSA-p423-j2cm-9vmq
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Affected versions changed · Red Hat
- 2026-11-04 3 new references · CNA
- 2026-11-04 CVSS score changed · GHSA-p423-j2cm-9vmq
- 2026-11-04 Weakness changed · GHSA-p423-j2cm-9vmq
- 2026-11-04 30 new references · GHSA-p423-j2cm-9vmq
- 2026-11-06 Fix available: RHSA-2026:42644 · Red Hat
References
Advisory 3
Other 32
- https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5
- https://github.com/pyca/cryptography/commit/c09d38ae52de7d95fe683b7a7c496f5751616f27
- https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-36.yaml
- https://access.redhat.com/errata/RHSA-2026:43651
- https://access.redhat.com/errata/RHSA-2026:43670
- https://access.redhat.com/errata/RHSA-2026:43851
- https://access.redhat.com/errata/RHSA-2026:43853
- https://access.redhat.com/errata/RHSA-2026:43854
- https://access.redhat.com/errata/RHSA-2026:43855
- https://access.redhat.com/errata/RHSA-2026:46956
- https://access.redhat.com/errata/RHSA-2026:7295
- https://access.redhat.com/security/cve/CVE-2026-39892
- https://bugzilla.redhat.com/show_bug.cgi?id=2456735
- https://github.com/pyca/cryptography
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39892.json
- https://access.redhat.com/errata/RHSA-2026:19375
- https://access.redhat.com/errata/RHSA-2026:20338
- https://access.redhat.com/errata/RHSA-2026:21017
- https://access.redhat.com/errata/RHSA-2026:22465
- https://access.redhat.com/errata/RHSA-2026:22629
- https://access.redhat.com/errata/RHSA-2026:22840
- https://access.redhat.com/errata/RHSA-2026:23361
- https://access.redhat.com/errata/RHSA-2026:24483
- https://access.redhat.com/errata/RHSA-2026:24761
- https://access.redhat.com/errata/RHSA-2026:24762
- https://access.redhat.com/errata/RHSA-2026:24853
- https://access.redhat.com/errata/RHSA-2026:24866
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:30088
- https://access.redhat.com/errata/RHSA-2026:30089
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:42644
More pyca vulnerabilities
- TI-2026-48588 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVSS 4.0HIGH 8.7
- TI-2026-48587 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees CVSS 4.0MEDIUM 6.9
- TI-2026-48586 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing CVSS 4.0HIGH 8.2
Sources
- CVE-2026-39892 · CVE Program
- CVE-2026-39892 · NVD
- FIRST EPSS
- GHSA-p423-j2cm-9vmq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-39892 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences