Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 7.5, published 15 June 2026.

Which products and versions are affected?

cryptography (PyPI) >= 0.5.0, < 48.0.1.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Pyca Cryptography vulnerable OpenSSL in pre-compiled wheels

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 7.5 · Published 2026-06-15

The pyca/cryptography library, a widely used Python package for secure data handling, distributed pre-compiled versions (wheels) containing a vulnerable version of the OpenSSL security engine. An attacker could exploit these underlying flaws to cause application crashes, memory corruption, or potentially execute unauthorized code. Organizations using the standard pre-built versions of this library should update to ensure their encryption infrastructure remains secure.

Technologies: cryptography (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 7.5, published 15 June 2026.
Which products and versions are affected?: cryptography (PyPI) >= 0.5.0, < 48.0.1.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The pyca/cryptography library's pre-compiled 'wheels' (distributed via PyPI) include a statically linked copy of OpenSSL that is vulnerable to several security issues, most notably a high-severity heap use-after-free in the PKCS7_verify() function. This specific flaw is triggered by specially crafted PKCS#7 or S/MIME signed messages containing an empty ASN.1 SET in the digestAlgorithms field, leading to incorrect freeing of a caller-owned BIO object. Attackers can exploit this via the network without authentication to cause a denial-of-service (crash) or potentially achieve remote code execution. Other bundled vulnerabilities include cryptographic bypasses in CMS AuthEnvelopedData and memory exhaustion in QUIC handling. Users are advised to upgrade to version 48.0.1.

Affected products

pyca cryptography >= 0.5.0, < 48.0.1

Timeline

2026-06-09: disclosed: Initial disclosure of OpenSSL vulnerabilities and cryptography advisory.
2026-06-15: advisory: GitHub Advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.