Buffer Overflow Vulnerability in py3-cryptography Package
Summary
ALPINE-CVE-2026-39892: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Affects py3-cryptography versions < 46.0.7-r0. Fixed in 46.0.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The py3-cryptography package is a widely used library in Python that provides cryptographic primitives and recipes for developers. It is designed to simplify the implementation of secure communication and data protection. However, certain versions of this package are susceptible to a critical vulnerability that can lead to buffer overflows, potentially compromising application security.
Vulnerability Detail
The vulnerability arises from the handling of non-contiguous buffers passed to APIs that accept Python buffers, such as Hash.update(). This flaw exists in versions from 45.0.0 up to, but not including, 46.0.7. If exploited, it could lead to buffer overflows, which may allow attackers to execute arbitrary code or cause a denial of service, thereby affecting the integrity and availability of the application.
How To Fix
Minimum fixed version
46.0.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade py3-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing non-contiguous buffers to the affected APIs until the package can be updated. This may involve modifying the code to ensure that only contiguous buffers are used in calls to functions like Hash.update().
Conclusion
The buffer overflow vulnerability in the py3-cryptography package poses significant risks to applications using affected versions. It is crucial to update to version 46.0.7 or later to mitigate these risks. Additionally, employing Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring better security for your applications.
See every vulnerability recorded for py3-cryptography →
FAQ
The buffer overflow vulnerability can lead to arbitrary code execution or denial of service, compromising the security and stability of applications using the affected package.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By simply uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
Versions from 45.0.0 up to, but not including, 46.0.7 are affected by this vulnerability.
Yes, you can avoid using non-contiguous buffers in your code as a temporary measure until you can update to the patched version.
More details can be found in the CVE report for CVE-2026-39892, which outlines the specifics of the vulnerability and its implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for py3-cryptography.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
