CVE-2026-39892: Cryptography Package Buffer Overflow Vulnerability
Summary
CVE-2026-39892: Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs. Affects cryptography versions >= 45.0.0, < 46.0.7. Fixed in 46.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'cryptography' package is a widely used library in Python that provides cryptographic recipes and primitives to developers. It enables secure communication and data protection through various cryptographic algorithms. However, it has been identified that certain APIs within this package are vulnerable to buffer overflow when non-contiguous buffers are passed, particularly affecting versions prior to 46.0.7.
Vulnerability Detail
The vulnerability arises when non-contiguous buffers are passed to APIs that accept Python buffers, such as the Hash.update() method. This can lead to buffer overflows, where the program reads beyond the allocated memory, potentially causing crashes or allowing attackers to execute arbitrary code. For instance, using the following code snippet could trigger the vulnerability:
h = Hash(SHA256())
b.update(buf[::-1])
This issue is particularly critical in Python versions greater than 3.11, where the risk of reading past the end of the buffer is heightened.
How To Fix
Latest published version: 50.0.2 as of 22 Oct 2026
pip install --upgrade "cryptography==50.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
46.0.7
This is the first release that contains the fix.
pip install --upgrade "cryptography==46.0.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing non-contiguous buffers to the affected APIs. Ensure that the buffers you pass are contiguous to prevent triggering the buffer overflow. For example, instead of using:
h.update(buf[::-1])
use:
h.update(buf)
Conclusion
In summary, CVE-2026-39892 presents a buffer overflow vulnerability in the 'cryptography' package, which can be mitigated by updating to version 46.0.7 or later. It is crucial for developers to ensure they are using the latest version to maintain the security of their applications.
See every vulnerability recorded for cryptography →
FAQ
CVE-2026-39892 is a vulnerability in the 'cryptography' package that can lead to buffer overflow when non-contiguous buffers are passed to certain APIs.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring signup.
The consequences include application crashes and the potential for arbitrary code execution, which can compromise the security of your application.
You can update the package by running the command 'pip install --upgrade cryptography' in your terminal.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for cryptography.
