# cryptography (PyPI) vulnerabilities

Source: https://junglewise.ai/threats/technologies/cryptography  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/cryptography.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 24 vulnerabilities in cryptography (PyPI): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-69248, was published on 3 August 2026.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 24 (1 critical, 0 exploited in the wild)

## About cryptography (PyPI)

Python cryptographic library providing recipe implementations and low-level interfaces to cryptographic primitives.

## Latest cryptography (PyPI) vulnerabilities

- [CVE-2026-69248: pyca cryptography improper certificate validation in Name Constraints](https://junglewise.ai/threats/cve-2026-69248-pyca-cryptography-improper-certificate-validation-in-name) (medium, CVSS 4, published 3 Aug 2026)
- [CVE-2026-69249: Pyca Cryptography exponential path-building in X.509 verification](https://junglewise.ai/threats/cve-2026-69249-pyca-cryptography-exponential-path-building-in-x-509-verification) (high, CVSS 4, published 3 Aug 2026)
- [CVE-2026-69247: pyca cryptography Bleichenbacher oracle in PKCS#7 decryption](https://junglewise.ai/threats/cve-2026-69247-pyca-cryptography-bleichenbacher-oracle-in-pkcs-7-decryption) (high, CVSS 4, published 3 Aug 2026)
- [CVE-2024-12797: PYSEC-2026-1284 - Vulnerable OpenSSL included in cryptography wheels](https://junglewise.ai/threats/cve-2024-12797-vulnerable-openssl-included-in-cryptography-wheels) (info, published 7 Jul 2026)
- [CVE-2023-50782: PYSEC-2026-1283 - Python Cryptography package vulnerable to Bleichenbacher timing oracle attack](https://junglewise.ai/threats/cve-2023-50782-python-cryptography-package-vulnerable-to-bleichenbacher-timing) (low, CVSS 3.1, published 7 Jul 2026)
- [Pyca Cryptography vulnerable OpenSSL in pre-compiled wheels](https://junglewise.ai/threats/pyca-cryptography-vulnerable-openssl-in-pre-compiled-wheels-d6089b68) (high, CVSS 7.5, published 15 Jun 2026)
- [CVE-2026-39892: PyCA cryptography buffer overflow in buffer-accepting APIs](https://junglewise.ai/threats/cve-2026-39892-pyca-cryptography-buffer-overflow-in-buffer-accepting-apis) (critical, CVSS 9.8, published 8 Apr 2026)
- [CVE-2026-34073: pyca cryptography incomplete DNS name constraint enforcement](https://junglewise.ai/threats/cve-2026-34073-pyca-cryptography-incomplete-dns-name-constraint-enforcement) (medium, CVSS 5.3, published 31 Mar 2026)
- [CVE-2026-26007: PyCA cryptography missing subgroup validation in SECT curves](https://junglewise.ai/threats/cve-2026-26007-pyca-cryptography-missing-subgroup-validation-in-sect-curves) (medium, CVSS 6.5, published 10 Feb 2026)
- [pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels](https://junglewise.ai/threats/pyca-cryptography-has-a-vulnerable-openssl-included-in-cryptography-728b5d8e) (info, published 3 Sep 2024)
- [CVE-2024-26130: PYSEC-2024-225 - cryptography is a package designed to expose cryptographic primitives and recipes to Python…](https://junglewise.ai/threats/cve-2024-26130-cryptography-null-pointer-dereference-with-pkcs12-serialize-key) (low, CVSS 3.1, published 21 Feb 2024)
- [CVE-2024-0727: OpenSSL NULL pointer dereference in PKCS12 decoding](https://junglewise.ai/threats/cve-2024-0727-openssl-null-pointer-dereference-in-pkcs12-decoding) (medium, CVSS 5.5, published 26 Jan 2024)
- [CVE-2023-49083: cryptography vulnerable to NULL-dereference when loading PKCS7 certificates](https://junglewise.ai/threats/cve-2023-49083-cryptography-vulnerable-to-null-dereference-when-loading-pkcs7) (low, CVSS 3.1, published 29 Nov 2023)
- [Vulnerable OpenSSL included in cryptography wheels](https://junglewise.ai/threats/vulnerable-openssl-included-in-cryptography-wheels-b0d6cf97) (info, published 21 Sep 2023)
- [pyca/cryptography's wheels include vulnerable OpenSSL](https://junglewise.ai/threats/pyca-cryptography-s-wheels-include-vulnerable-openssl-2382ff1e) (info, published 1 Aug 2023)
- [CVE-2023-38325: PYSEC-2023-112 - The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.](https://junglewise.ai/threats/cve-2023-38325-cryptography-mishandles-ssh-certificates) (low, CVSS 3.1, published 14 Jul 2023)
- [Vulnerable OpenSSL included in cryptography wheels](https://junglewise.ai/threats/vulnerable-openssl-included-in-cryptography-wheels-d2359a00) (info, published 2 Jun 2023)
- [CVE-2023-23931: Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf](https://junglewise.ai/threats/cve-2023-23931-cipher-update-into-can-corrupt-memory-if-passed-an-immutable) (low, CVSS 3.1, published 7 Feb 2023)
- [CVE-2023-0286: RUSTSEC-2023-0006 - X.400 address type confusion in X.509 `GeneralName`](https://junglewise.ai/threats/cve-2023-0286-vulnerable-openssl-included-in-cryptography-wheels) (low, CVSS 3.1, published 7 Feb 2023)
- [pyca cryptography vulnerable OpenSSL in wheels](https://junglewise.ai/threats/pyca-cryptography-vulnerable-openssl-in-wheels-1b0dbb8c) (info, published 2 Nov 2022)
- [CVE-2020-36242: PyCA Cryptography symmetrically encrypting large values can lead to integer overflow](https://junglewise.ai/threats/cve-2020-36242-pyca-cryptography-symmetrically-encrypting-large-values-can-lead) (low, CVSS 3.1, published 7 Feb 2021)
- [CVE-2020-25659: RSA decryption vulnerable to Bleichenbacher timing vulnerability](https://junglewise.ai/threats/cve-2020-25659-rsa-decryption-vulnerable-to-bleichenbacher-timing-vulnerability) (low, CVSS 3.1, published 11 Jan 2021)
- [CVE-2018-10903: PyCA Cryptography vulnerable to GCM tag forgery](https://junglewise.ai/threats/cve-2018-10903-pyca-cryptography-vulnerable-to-gcm-tag-forgery) (low, CVSS 3, published 30 Jul 2018)
- [CVE-2016-9243: PYSEC-2017-8 - HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than…](https://junglewise.ai/threats/cve-2016-9243-improper-input-validation-in-cryptography) (low, CVSS 3, published 27 Mar 2017)

## Most severe cryptography (PyPI) vulnerabilities

- [CVE-2026-39892: PyCA cryptography buffer overflow in buffer-accepting APIs](https://junglewise.ai/threats/cve-2026-39892-pyca-cryptography-buffer-overflow-in-buffer-accepting-apis) (critical, CVSS 9.8, published 8 Apr 2026)
- [Pyca Cryptography vulnerable OpenSSL in pre-compiled wheels](https://junglewise.ai/threats/pyca-cryptography-vulnerable-openssl-in-pre-compiled-wheels-d6089b68) (high, CVSS 7.5, published 15 Jun 2026)
- [CVE-2026-69249: Pyca Cryptography exponential path-building in X.509 verification](https://junglewise.ai/threats/cve-2026-69249-pyca-cryptography-exponential-path-building-in-x-509-verification) (high, CVSS 4, published 3 Aug 2026)
- [CVE-2026-69247: pyca cryptography Bleichenbacher oracle in PKCS#7 decryption](https://junglewise.ai/threats/cve-2026-69247-pyca-cryptography-bleichenbacher-oracle-in-pkcs-7-decryption) (high, CVSS 4, published 3 Aug 2026)
- [CVE-2026-26007: PyCA cryptography missing subgroup validation in SECT curves](https://junglewise.ai/threats/cve-2026-26007-pyca-cryptography-missing-subgroup-validation-in-sect-curves) (medium, CVSS 6.5, published 10 Feb 2026)
- [CVE-2024-0727: OpenSSL NULL pointer dereference in PKCS12 decoding](https://junglewise.ai/threats/cve-2024-0727-openssl-null-pointer-dereference-in-pkcs12-decoding) (medium, CVSS 5.5, published 26 Jan 2024)
- [CVE-2026-34073: pyca cryptography incomplete DNS name constraint enforcement](https://junglewise.ai/threats/cve-2026-34073-pyca-cryptography-incomplete-dns-name-constraint-enforcement) (medium, CVSS 5.3, published 31 Mar 2026)
- [CVE-2026-69248: pyca cryptography improper certificate validation in Name Constraints](https://junglewise.ai/threats/cve-2026-69248-pyca-cryptography-improper-certificate-validation-in-name) (medium, CVSS 4, published 3 Aug 2026)
- [CVE-2023-0286: RUSTSEC-2023-0006 - X.400 address type confusion in X.509 `GeneralName`](https://junglewise.ai/threats/cve-2023-0286-vulnerable-openssl-included-in-cryptography-wheels) (low, CVSS 3.1, published 7 Feb 2023)
- [CVE-2020-36242: PyCA Cryptography symmetrically encrypting large values can lead to integer overflow](https://junglewise.ai/threats/cve-2020-36242-pyca-cryptography-symmetrically-encrypting-large-values-can-lead) (low, CVSS 3.1, published 7 Feb 2021)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other PyPI technologies

- [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities
- [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities
- [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities
- [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities
- [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities
- [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities
- [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities
- [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities
- [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities
- [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities
- [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities
- [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "cryptography (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/cryptography, 13 November 2026.