Skip to content
fr Sign in
6.9 Medium

CVE-2026-39892 cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
Interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
cryptography 45.0 45.0.0 → < 46.0.7 46.0.7
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Red Hat AI Inference Server 3.3 1782352847 earliest → < 1782352847 1782352847
Red Hat Ansible Automation Platform 2.6 1779760844 earliest → < 1779760844 1779760844
Red Hat Discovery 2 1779395228 earliest → < 1779395228 1779395228
Red Hat Hardened Images 46.0 earliest → < 46.0.7-1.hum1 46.0.7-1.hum1
Red Hat OpenShift AI 2.25 1783701598 earliest → < 1783701598 1783701598
Show the 24 other branches
Product Affected versions Fixed in
Red Hat Quay 3.12 1779811412 earliest → < 1779811412 1779811412
Red Hat Quay 3.14 1779689392 earliest → < 1779689392 1779689392
Red Hat Quay 3.15 1780891395 earliest → < 1780891395 1780891395
Red Hat Quay 3.16 1779204086 earliest → < 1779204086 1779204086
Red Hat Quay 3.17 1779922205 earliest → < 1779922205 1779922205
Red Hat Quay 3.1 1779822261 earliest → < 1779822261 1779822261
Red Hat Quay 3.9 1779811473 earliest → < 1779811473 1779811473
Red Hat Trusted Artifact Signer 1.4 1780914886 earliest → < 1780914886 1780914886
Lightspeed Core Versions not published
Migration Toolkit for Applications 8 Versions not published
Red Hat AI Inference Server Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Ansible Automation Platform Ansible Core 2 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat Quay 3 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 10 Versions not published
OpenShift Lightspeed Versions not published
Red Hat Quay 3.10 1779822261 earliest → < 1779822261 1779822261
Red Hat OpenShift AI 3.3 1782471606 earliest → < 1782471606 1782471606
Red Hat Enterprise Linux AI 3.3 1785163184 earliest → < 1785163184 1785163184

References

Timeline

  1. Published
  2. Last modified

Other CVEs of cryptography

The 9 CVEs of cryptography →
CVE-2026-69249 python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers 8.7 High CVE-2026-69248 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers 6.9 Medium CVE-2026-69247 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers 8.2 High CVE-2026-34073 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers 1.7 Low
Track this CVE