Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11

Export CSV
CVE-2026-39892

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cryptography.io Pyca
Products
Cryptography Cryptography
CVE-2026-34073

cryptography has incomplete DNS name constraint enforcement on peer names

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed
Vendors
Cryptography.io Pyca
Products
Cryptography Cryptography
CVE-2026-26007

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Cryptography.io Pyca
Products
Cryptography Cryptography
CVE-2023-50782

Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659

A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Couchbase Cryptography.io Redhat
Products
Couchbase Server Cryptography Ansible Automation Platform and 4 more
CVE-2023-49083

cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cryptography.io Redhat
Products
Cryptography Ansible Automation Platform Enterprise Linux and 2 more
CVE-2023-23931

Cipher.update_into can corrupt memory in pyca cryptography

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.

CVSS 3.1 · 4.8 Medium EPSS 1.3% KEV · Not listed
Vendors
Cryptography.io Redhat
Products
Cryptography Ansible Automation Platform Enterprise Linux and 2 more
CVE-2024-26130

cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cryptography.io Redhat
Products
Cryptography Ansible Automation Platform Rhui and 2 more
CVE-2023-38325

python-cryptography: SSH certificate encoding/parsing incompatibility with OpenSSH

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cryptography.io
Products
Cryptography
CVE-2020-36242

python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

CVSS 3.1 · 9.1 Critical EPSS 6.8% KEV · Not listed
Vendors
Cryptography.io Fedoraproject Oracle and 1 more
Products
Cryptography Fedora Communications Cloud Native Core Network Function Cloud Native Environment and 3 more