CVE-2026-26007: cryptography Package Vulnerable to Subgroup Attack Due to Missing Subgroup Validation
Summary
CVE-2026-26007: cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves. Affects cryptography versions < 46.0.5. Fixed in 46.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cryptography package is a widely used library in Python that provides cryptographic recipes and primitives to developers. It supports various cryptographic algorithms and protocols, making it essential for secure communication and data protection. However, it has a vulnerability related to SECT curves, which can lead to significant security risks if not addressed.
Vulnerability Detail
The vulnerability arises from the functions public_key_from_numbers, EllipticCurvePublicNumbers.public_key(), load_der_public_key(), and load_pem_public_key() not validating that a public key point belongs to the expected prime-order subgroup of the curve. This oversight allows attackers to use public keys from small-order subgroups, potentially leaking information about the victim's private key during operations like ECDH and enabling signature forgery in ECDSA. Only SECT curves are affected by this issue.
How To Fix
Latest published version: 50.0.2 as of 22 Oct 2026
pip install --upgrade "cryptography==50.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
46.0.5
This is the first release that contains the fix.
pip install --upgrade "cryptography==46.0.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability other than updating to the patched version of the package.
Conclusion
The cryptography package has a significant vulnerability related to SECT curves that can lead to serious security issues. It is essential to update to version 46.0.5 or later to protect against potential attacks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for cryptography →
FAQ
The vulnerability allows attackers to exploit missing subgroup validation for SECT curves, leading to potential private key leakage and signature forgery.
Versions of the cryptography package up to and including 46.0.4 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version as soon as possible to mitigate the risk.
The vulnerability was discovered by the XlabAI Team of Tencent Xuanwu Lab and the Atuin Automated Vulnerability Discovery Engine.
References
Related vulnerabilities
Recent vulnerabilities recorded for cryptography.
