cryptography.io vulnerabilities

Products

• cryptography 11

Latest cryptography.io CVEs

Newest publication first

1. CVE-2026-39892 cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

   Published 2026-04-08

   Medium·CVSS 6.9 EPSS 0.68%

   cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulner...

2. CVE-2026-34073 cryptography has incomplete DNS name constraint enforcement on peer names

   Published 2026-03-31

   Low·CVSS 1.7 EPSS 0.23%

   cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently...

3. CVE-2026-26007 cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

   Published 2026-02-10

   High·CVSS 8.2 EPSS 0.38%

   cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_ke...

4. CVE-2024-26130 cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

   Published 2024-02-21

   High·CVSS 7.5 EPSS 0.83%

   cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if pkcs12.serialize_key_and_certificates is called with both a certificate whose public key did not match the provided p...

5. CVE-2023-50782 Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659

   Published 2024-02-05

   High·CVSS 7.5 EPSS 1.1%

   A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

6. CVE-2023-49083 cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

   Published 2023-11-29

   High·CVSS 7.5 EPSS 0.99%

   cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious ris...

7. CVE-2023-38325 cryptography mishandles SSH certificates

   Published 2023-07-14

   High·CVSS 7.5 EPSS 0.73%

   The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

8. CVE-2023-23931 Cipher.update_into can corrupt memory in pyca cryptography

   Published 2023-02-07

   Medium·CVSS 6.5 EPSS 1.3%

   cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.update_into would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects...

9. CVE-2020-36242 PyCA Cryptography symmetrically encrypting large values can lead to integer overflow

   Published 2021-02-07

   Critical·CVSS 9.1 EPSS 6.8%

   In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

10. CVE-2020-25659 RSA decryption vulnerable to Bleichenbacher timing vulnerability

    Published 2021-01-11

    Medium·CVSS 5.9 EPSS 2.5%

    python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

11. CVE-2016-9243 Improper input validation in cryptography

    Published 2017-03-27

    High·CVSS 7.5 EPSS 3.5%

    HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.