pyca/cryptography · Security
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
- GHSA ID
- GHSA-p423-j2cm-9vmq
- CVE ID
- CVE-2026-39892
- Severity
- medium
- Published
- Updated
- CVSS v4
- 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Description
If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. For example:
h = Hash(SHA256())
b.update(buf[::-1])
would read past the end of the buffer on Python >3.11
CWEs
- CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-39892 ↗
- http://www.openwall.com/lists/oss-security/2026/04/08/12 ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-36.yaml ↗
- https://github.com/advisories/GHSA-p423-j2cm-9vmq ↗