# CVE-2026-69247: pyca cryptography Bleichenbacher oracle in PKCS#7 decryption

Source: https://junglewise.ai/threats/cve-2026-69247-pyca-cryptography-bleichenbacher-oracle-in-pkcs-7-decryption  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-08-03  
License: CC BY 4.0 with a link back

CVE-2026-69247 · Severity: high · CVSS 4 · Published 2026-08-03

A vulnerability in the 'cryptography' Python library could allow an attacker to decrypt sensitive data without knowing the correct password or key. This affects systems that automatically process encrypted emails or files, such as secure email gateways. If exploited, an attacker could eventually recover the secret keys used to protect corporate communications.

Technologies: [cryptography (PyPI)](https://junglewise.ai/threats/technologies/cryptography). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-69247 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69247 being exploited in the wild.

**How severe is CVE-2026-69247?** High severity, with a CVSS score of 4, published 3 August 2026.

**Which products and versions are affected?** cryptography (PyPI) >= 44.0.0, < 50.0.0, ECOSYSTEM:introduced=44.0.0,fixed=50.0.0.

**Is there a fix for CVE-2026-69247?** Yes. cryptography (PyPI): upgrade to 50.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69247 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69247?** Check whether you run cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- cryptography (PyPI): upgrade to 50.0.0 or later

  ```sh
  pip install "cryptography>=50.0.0"
  ```


## Technical details

The functions pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime fail to implement RFC 3218 mitigations, leading to a Bleichenbacher oracle. The implementation leaks information through distinguishable error messages and timing differences during the RSA PKCS#1 v1.5 decryption of the 'encryptedKey' field. Specifically, the library distinguishes between invalid RSA padding, incorrect key lengths, and padding errors in the subsequent AES-CBC decryption. This allows a remote attacker to perform a chosen-ciphertext attack to recover the content-encryption key. The vulnerability is fixed in version 50.0.0 by ensuring all decryption paths perform identical work and return uniform error responses.

## Affected products

- pyca cryptography >= 44.0.0, < 50.0.0

## Identifiers

- CVE-2026-69247
- GHSA-g6cj-pr64-35w5
- PYSEC-2026-3552

## Timeline

- 2026-07-31: disclosed
- 2026-08-03: advisory
- 2026-08-03: patched

## References

- [https://api.github.com/users/X1AOxiang](https://api.github.com/users/X1AOxiang)
- [https://github.com/X1AOxiang](https://github.com/X1AOxiang)
- [https://api.github.com/users/X1AOxiang/gists%7B/gist_id%7D](https://api.github.com/users/X1AOxiang/gists%7B/gist_id%7D)
- [https://api.github.com/users/X1AOxiang/repos](https://api.github.com/users/X1AOxiang/repos)
- [https://avatars.githubusercontent.com/u/137020166?v=4](https://avatars.githubusercontent.com/u/137020166?v=4)
- [https://api.github.com/users/X1AOxiang/events%7B/privacy%7D](https://api.github.com/users/X1AOxiang/events%7B/privacy%7D)

## Related threats

- [pyca cryptography improper certificate validation in Name Constraints](https://junglewise.ai/threats/cve-2026-69248-pyca-cryptography-improper-certificate-validation-in-name)
- [Pyca Cryptography exponential path-building in X.509 verification](https://junglewise.ai/threats/cve-2026-69249-pyca-cryptography-exponential-path-building-in-x-509-verification)
- [PYSEC-2026-1284 - Vulnerable OpenSSL included in cryptography wheels](https://junglewise.ai/threats/cve-2024-12797-vulnerable-openssl-included-in-cryptography-wheels)
- [PYSEC-2026-1283 - Python Cryptography package vulnerable to Bleichenbacher timing oracle attack](https://junglewise.ai/threats/cve-2023-50782-python-cryptography-package-vulnerable-to-bleichenbacher-timing)
- [Pyca Cryptography vulnerable OpenSSL in pre-compiled wheels](https://junglewise.ai/threats/pyca-cryptography-vulnerable-openssl-in-pre-compiled-wheels-d6089b68)