Junglewise Threat Intelligence

CVE-2026-39892: PyCA cryptography buffer overflow in buffer-accepting APIs

CVE-2026-39892 · Severity: critical · CVSS 9.8 · Published 2026-04-08

Executive brief

The 'cryptography' library, a widely used tool for securing data in Python applications, contains a flaw that could lead to a system crash or unauthorized code execution. This occurs when the library processes specific types of data memory layouts incorrectly. If an application uses this library to handle untrusted data, an attacker could potentially compromise the service or access sensitive information.

Technical details

A buffer overflow vulnerability exists in the PyCA cryptography package (versions 45.0.0 to 46.0.6) when non-contiguous Python buffers are passed to certain APIs, such as Hash.update(). On Python versions greater than 3.11, passing a sliced or reversed buffer (e.g., buf[::-1]) can cause the library to read or write past the allocated memory bounds. This is due to improper handling of the Python buffer protocol for non-contiguous memory layouts. An attacker who can influence the data passed to these cryptographic functions could potentially achieve arbitrary code execution or cause a denial of service. The issue is resolved in version 46.0.7.

Affected products

  • PyCA cryptography >=45.0.0, <46.0.7

Timeline

  • 2026-04-07: patched: Version 46.0.7 released to PyPI
  • 2026-04-08: disclosed: Public advisory published

References

Related threats