CVE-2026-39892: PyCA cryptography buffer overflow in buffer-accepting APIs

CVE-2026-39892 · Severity: critical · CVSS 9.8 · Published 2026-04-08

The 'cryptography' library, a widely used tool for securing data in Python applications, contains a flaw that could lead to a system crash or unauthorized code execution. This occurs when the library processes specific types of data memory layouts incorrectly. If an application uses this library to handle untrusted data, an attacker could potentially compromise the service or access sensitive information.

Technologies: cryptography (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-39892 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39892 being exploited in the wild.
How severe is CVE-2026-39892?
Critical severity, with a CVSS score of 9.8, published 8 April 2026.
Which products and versions are affected?
cryptography (PyPI) >= 45.0.0, < 46.0.7, ECOSYSTEM:introduced=45.0.0,fixed=46.0.7.
Is there a fix for CVE-2026-39892?
Yes. cryptography (PyPI): upgrade to 46.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39892 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-39892?
Check whether you run cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • cryptography (PyPI): upgrade to 46.0.7 or later
    pip install "cryptography>=46.0.7"

Technical details

A buffer overflow vulnerability exists in the PyCA cryptography package (versions 45.0.0 to 46.0.6) when non-contiguous Python buffers are passed to certain APIs, such as Hash.update(). On Python versions greater than 3.11, passing a sliced or reversed buffer (e.g., buf[::-1]) can cause the library to read or write past the allocated memory bounds. This is due to improper handling of the Python buffer protocol for non-contiguous memory layouts. An attacker who can influence the data passed to these cryptographic functions could potentially achieve arbitrary code execution or cause a denial of service. The issue is resolved in version 46.0.7.

Affected products

  • PyCA cryptography >=45.0.0, <46.0.7

Identifiers

  • CVE-2026-39892
  • GHSA-p423-j2cm-9vmq
  • PYSEC-2026-36

Timeline

  • 2026-04-07: patched: Version 46.0.7 released to PyPI
  • 2026-04-08: disclosed: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.