pyca/cryptography Security Advisories

medium2026-08-03

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

GHSA-m2h6-j472-rp4c · CVE-2026-69248

high2026-08-03

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

GHSA-jwv3-5hgf-82ww · CVE-2026-69249

high2026-08-03

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

GHSA-g6cj-pr64-35w5 · CVE-2026-69247

high2026-06-15

Vulnerable OpenSSL included in cryptography wheels

GHSA-537c-gmf6-5ccf

medium2026-04-08

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

GHSA-p423-j2cm-9vmq · CVE-2026-39892

low2026-03-27

cryptography has incomplete DNS name constraint enforcement on peer names

GHSA-m959-cc7f-wv43 · CVE-2026-34073

high2026-02-10

cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

GHSA-r6ph-v2qm-q3c2 · CVE-2026-26007

low2025-02-11

Vulnerable OpenSSL included in cryptography wheels

GHSA-79v4-65xg-pq4g · CVE-2024-12797

medium2024-09-03

pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels

GHSA-h4gh-qq45-vh27

high2024-02-21

cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

GHSA-6vqw-3v5j-54x4 · CVE-2024-26130

high2024-02-05

Python Cryptography package vulnerable to Bleichenbacher timing oracle attack

GHSA-3ww4-gg4f-jr7f · CVE-2023-50782

medium2023-11-28

cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

GHSA-jfhm-5ghh-2f97 · CVE-2023-49083

low2023-09-21

Vulnerable OpenSSL included in cryptography wheels

GHSA-v8gr-m533-ghj9

low2023-08-01

pyca/cryptography's wheels include vulnerable OpenSSL

GHSA-jm77-qphf-c4w8

high2023-07-14

cryptography mishandles SSH certificates

GHSA-cf7p-gm2m-833m · CVE-2023-38325

low2023-06-02

Vulnerable OpenSSL included in cryptography wheels

GHSA-5cpq-8wj7-hf2v

high2023-02-08

Vulnerable OpenSSL included in cryptography wheels

GHSA-x4qr-2fvf-3mr5 · CVE-2023-0286

medium2023-02-07

Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf

GHSA-w7pp-m8wf-vj6r · CVE-2023-23931

medium2022-11-02

Vulnerable OpenSSL included in cryptography wheels

GHSA-39hc-v87j-747x

high2022-05-17

Improper input validation in cryptography

GHSA-q3cj-2r34-2cwc · CVE-2016-9243