CVE-2026-39892
published 2026-04-08CVE-2026-39892: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.65%
47.1th percentile
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cryptography.io | cryptography | >= 45.0.0 < 46.0.7 | 46.0.7 |
| cryptography.io | cryptography | >= 45.0.0 < 46.0.7 | 46.0.7 |
| debian | python-cryptography | < python-cryptography 46.0.7-1 (sid) | python-cryptography 46.0.7-1 (sid) |
| pyca | cryptography | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.9MEDIUM
vendor_debian6.9LOW
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-39892: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
osv·2026-04-08·CVSS 6.9
CVE-2026-39892 [MEDIUM] CVE-2026-39892: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
GHSA
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
ghsa·2026-04-08
CVE-2026-39892 [MEDIUM] CWE-119 Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. `Hash.update()`), this could lead to buffer overflows. For example:
```python
h = Hash(SHA256())
b.update(buf[::-1])
```
would read past the end of the buffer on Python >3.11
OSV
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
osv·2026-04-08
CVE-2026-39892 [MEDIUM] Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. `Hash.update()`), this could lead to buffer overflows. For example:
```python
h = Hash(SHA256())
b.update(buf[::-1])
```
would read past the end of the buffer on Python >3.11
Red Hat
cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API
vendor_redhat·2026-04-08·CVSS 6.9
CVE-2026-39892 [MEDIUM] CWE-131 cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API
cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API
A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: redhat-user-workloads/lightspeed-stack (Lightspeed Core) - Fix deferred
Package: redhat-user-workloads/rag-tool (Lightspeed Core) - Fix defe
Debian
CVE-2026-39892: python-cryptography - cryptography is a package designed to expose cryptographic primitives and recipe...
vendor_debian·2026·CVSS 6.9
CVE-2026-39892 [MEDIUM] CVE-2026-39892: python-cryptography - cryptography is a package designed to expose cryptographic primitives and recipe...
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
Scope: local
bookworm: resolved
bullseye: resolved
forky: open
sid: resolved (fixed in 46.0.7-1)
trixie: resolved
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-35604 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-35604 [MEDIUM] CVE-2026-35604 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35604 :
Wolfi vulnerability analysis and mitigation
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticated users. The public share download handler does not re-check the share owner's current permissions. This vulnerability is fixed in 2.63.1.
Source : NVD
## 8.2
Score
Published April 7, 2026
Severity HIGH
CNA Score 8.2
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 17.4
Exploitation Probab
Wiz
CVE-2026-35606 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-35606 [MEDIUM] CVE-2026-35606 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35606 :
Wolfi vulnerability analysis and mitigation
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other content-serving endpoints (/api/raw, /api/preview, /api/subtitle) correctly verify this permission before serving content. A user with download: false can read any text file within their scope through two bypass paths. This vulnerability is fixed in 2.63.1.
Source : NVD
## 5.3
Score
Published April 7, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
C
Wiz
CVE-2026-35607 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-35607 [MEDIUM] CVE-2026-35607 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35607 :
Wolfi vulnerability analysis and mitigation
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 ("self-registered users don't get execute perms") stripped Execute permission and Commands from users created via the signup handler. The same fix was not applied to the proxy auth handler. Users auto-created on first successful proxy-auth login are granted execution capabilities from global defaults, even though the signup path was explicitly changed to prevent execution rights from being inherited by automatically provisioned accounts. This vulnerability is fixed in 2.63.1.
Source : NVD
## 8.1
Score
Published April 7, 2026
Severity HIGH
C
Wiz
CVE-2026-35605 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-35605 [MEDIUM] CVE-2026-35605 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35605 :
Wolfi vulnerability analysis and mitigation
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the Matches() function in rules/rules.go uses strings.HasPrefix() without a trailing directory separator when matching paths against access rules. A rule for /uploads also matches /uploads_backup/, granting or denying access to unintended directories. This vulnerability is fixed in 2.63.1.
Source : NVD
## 6.3
Score
Published April 7, 2026
Severity MEDIUM
CNA Score 6.3
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 19.6
Exploitatio
Wiz
CVE-2026-39892 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.9
CVE-2026-39892 [MEDIUM] CVE-2026-39892 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-39892 :
Python vulnerability analysis and mitigation
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
Source : NVD
## 6.9
Score
Published April 8, 2026
Severity MEDIUM
CNA Score 6.9
Affected Technologies
Python
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 13
Exploitation Probability (EPSS) N/A
Affected packages and libraries
fence-agents-ibm-vpc
fence-agents-nutanix-ahv
Sources
NVD
Alpine 3.23, edge Has
Wiz
CVE-2026-34371 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2026-34371 [MEDIUM] CVE-2026-34371 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34371 :
Chainguard vulnerability analysis and mitigation
LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the execute_code sandbox when persisting code-generated artifacts. On deployments using the default local file strategy, a malicious artifact filename containing traversal sequences (for example, ../../../../../app/client/dist/poc.txt) is concatenated into the server-side destination path and written with fs.writeFileSync() without sanitization. This gives any user who can trigger execute_code an arbitrary file write primitive as the LibreChat server user. This vulnerability is fixed in 0.8.4.
Source : NVD
## 6.3
Score
Published April 7, 2026
Severity MEDIUM
CNA Score 6.3
Affected Technologies
Cha
Wiz
CVE-2026-34972 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-34972 [MEDIUM] CVE-2026-34972 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34972 :
Wolfi vulnerability analysis and mitigation
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.
Source : NVD
## 5
Score
Published April 6, 2026
Severity MEDIUM
CNA Score 5.0
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 9.9
Exploitation Probability (EPSS) N/A
Affected packages and libraries
grafana-12.3
grafana-12.4
Source
Wiz
CVE-2026-39957 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-39957 [MEDIUM] CVE-2026-39957 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-39957 :
Wolfi vulnerability analysis and mitigation
Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('user_group_id') clause to escape the ownership filter applied by the when() block. Any authenticated non-admin user with upload permission who owns at least one album can retrieve all user-group-based sharing permissions across the entire instance, including private albums owned by other users. This vulnerability is fixed in 7.5.4.
Source : NVD
## 2.3
Score
Published April 9, 2026
Severity LOW
CNA Score 2.3
Affected Technologies
Wolfi
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Pro
Wiz
CVE-2026-35585 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-35585 [MEDIUM] CVE-2026-35585 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-35585 :
Wolfi vulnerability analysis and mitigation
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 through 2.63.1, the hook system in File Browser — which executes administrator-defined shell commands on file events such as upload, rename, and delete — is vulnerable to OS command injection. Variable substitution for values like $FILE and $USERNAME is performed via os.Expand without sanitization. An attacker with file write permission can craft a malicious filename containing shell metacharacters, causing the server to execute arbitrary OS commands when the hook fires. This results in Remote Code Execution (RCE). This feature has been disabled by default for all installations f
Bugzilla
CVE-2026-39892 pypy: Cryptography: Buffer overflow via non-contiguous buffer in API [fedora-all]
bugzilla·2026-04-09·CVSS 6.9
CVE-2026-39892 [MEDIUM] CVE-2026-39892 pypy: Cryptography: Buffer overflow via non-contiguous buffer in API [fedora-all]
CVE-2026-39892 pypy: Cryptography: Buffer overflow via non-contiguous buffer in API [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-39892 pypy3.11: Cryptography: Buffer overflow via non-contiguous buffer in API [fedora-all]
bugzilla·2026-04-09·CVSS 6.9
CVE-2026-39892 [MEDIUM] CVE-2026-39892 pypy3.11: Cryptography: Buffer overflow via non-contiguous buffer in API [fedora-all]
CVE-2026-39892 pypy3.11: Cryptography: Buffer overflow via non-contiguous buffer in API [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-39892 pypy3.10: Cryptography: Buffer overflow via non-contiguous buffer in API [fedora-all]
bugzilla·2026-04-09·CVSS 6.9
CVE-2026-39892 [MEDIUM] CVE-2026-39892 pypy3.10: Cryptography: Buffer overflow via non-contiguous buffer in API [fedora-all]
CVE-2026-39892 pypy3.10: Cryptography: Buffer overflow via non-contiguous buffer in API [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-39892 cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API
bugzilla·2026-04-08·CVSS 6.9
CVE-2026-39892 [MEDIUM] CVE-2026-39892 cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API
CVE-2026-39892 cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmqhttp://www.openwall.com/lists/oss-security/2026/04/08/12https://access.redhat.com/errata/RHSA-2026:19375https://access.redhat.com/errata/RHSA-2026:20338https://access.redhat.com/errata/RHSA-2026:21017https://access.redhat.com/errata/RHSA-2026:22465https://access.redhat.com/errata/RHSA-2026:22629https://access.redhat.com/errata/RHSA-2026:22840https://access.redhat.com/errata/RHSA-2026:23361https://access.redhat.com/errata/RHSA-2026:24483https://access.redhat.com/errata/RHSA-2026:24761https://access.redhat.com/errata/RHSA-2026:24762https://access.redhat.com/errata/RHSA-2026:24853https://access.redhat.com/errata/RHSA-2026:24866https://access.redhat.com/errata/RHSA-2026:24977https://access.redhat.com/errata/RHSA-2026:30088https://access.redhat.com/errata/RHSA-2026:30089https://access.redhat.com/errata/RHSA-2026:37275https://access.redhat.com/errata/RHSA-2026:7295https://access.redhat.com/security/cve/CVE-2026-39892https://bugzilla.redhat.com/show_bug.cgi?id=2456735https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39892.json
2026-04-08
Published