Fluid Attacks Database

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel9	fence-agents	-	-
alpine v3.23	py3-cryptography	>=45.0.0 <46.0.7-r0	46.0.7-r0
pypi	cryptography	>=45.0.0 <46.0.7	46.0.7
debian 14	python-cryptography	=43.0.0-3 \|\| =44.0.2-1 \|\| =44.0.2-2 \|\| =45.0.6-1 \|\| =45.0.6-1~exp1 \|\| =45.0.7-1 \|\| =46.0.1-1 \|\| =46.0.1-1~exp1 \|\| =46.0.5-1 \|\| =46.0.5-2 \|\| =46.0.6-1 \|\| >=0 <46.0.7-1	46.0.7-1
rpm rhel8	fence-agents	-	-
alpine v3.24	py3-cryptography	>=45.0.0 <46.0.7-r0	46.0.7-r0

Aliases

1. CVE-2026-398922. NVD-2026-398923. OSV-2026-398924. OSV-ALPINE-2026-398925. OSV-DEBIAN-2026-398926. GHSA-p423-j2cm-9vmq7. GCVE-2026-398928. SECURITY-CVE-2026-398929. SECURITY-TRACKER-CVE-2026-39892

References

1. https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq2. https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-36.yaml3. http://www.openwall.com/lists/oss-security/2026/04/08/12

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.