Severity
8.2HIGH
EPSS
0.0%
top 99.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 10
Latest updateMar 12
Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead …
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Packages4 packages
Patches
🔴Vulnerability Details
4OSV▶
cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves↗2026-02-10
GHSA▶
cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves↗2026-02-10
OSV▶
CVE-2026-26007: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers↗2026-02-10
📋Vendor Advisories
3🕵️Threat Intelligence
1💬Community
1Bugzilla▶
CVE-2026-26007 cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves↗2026-02-10