~ / search / GHSA-p423-j2cm-9vmq

GHSA-p423-j2cm-9vmq

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-39892

Packages

EcosystemPackageAffectedFixed in
PyPI cryptography >= 45.0.0, < 46.0.7 46.0.7

Details

As written in the advisory (Markdown source, shown as plain text).

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. `Hash.update()`), this could lead to buffer overflows. For example: ```python h = Hash(SHA256()) b.update(buf[::-1]) ``` would read past the end of the buffer on Python >3.11

References

External links from the advisory. They lead to third-party sites.