GHSA-p423-j2cm-9vmqMedium

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

Published
April 8, 2026
Last Modified
June 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-39892 →

📋 Description

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. For example:

h = Hash(SHA256())
b.update(buf[::-1])

would read past the end of the buffer on Python >3.11

🎯 Affected products1

  • pip/cryptography:>= 45.0.0, < 46.0.7

🔗 References (5)