Critical Vulnerability in py3-cryptography: Public Key Validation Flaw

py3-cryptography Updated 09 Mar 2026

Summary

10/02/2026

Disclosed on

N/A

Severity

Yes i

Fix available

Medium

Severity

6.5

CVSS Score

ALPINE-CVE-2026-26007: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Affects py3-cryptography versions < 46.0.5-r0. Fixed in 46.0.5-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The py3-cryptography package is a widely used library in Python that provides cryptographic primitives and recipes for developers. It enables secure communication and data protection through various cryptographic algorithms. However, prior to version 46.0.5, the package contained a significant vulnerability related to the validation of public keys, specifically in its handling of elliptic curve cryptography.

Vulnerability Detail

The vulnerability arises from the public_key_from_numbers and related functions not verifying that the provided public key point belongs to the expected prime-order subgroup of the elliptic curve. This oversight allows attackers to use public keys from small-order subgroups, which can lead to severe security issues. For instance, when a victim computes a shared secret using ECDH, it can leak information about their private key. This is particularly dangerous for curves with a cofactor greater than 1, as it can expose the least significant bits of the private key. Additionally, weak public keys can facilitate signature forgery in ECDSA, making this a critical vulnerability that affects only SECT curves.

How To Fix

Minimum fixed version

46.0.5-r0

This is the first release that contains the fix.

sudo apk add --upgrade py3-cryptography

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version of the package as outlined above.

Conclusion

The py3-cryptography package has a critical vulnerability that affects its public key validation process, potentially leading to severe security risks. It is essential for users to update to version 46.0.5 or later to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.

See every vulnerability recorded for py3-cryptography →