Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pyca | cryptography | < 46.0.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-cryptography | 46.0.5-1 | — |
| Debian 13 | python-cryptography | 43.0.0-3+deb13u1 | — |
| Debian 12 | python-cryptography | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | python-cryptography | 43.0.0-1ubuntu1.1 | USN-8087-1 |
| Ubuntu 24.04 LTS | python-cryptography | 41.0.7-4ubuntu0.3 | USN-8087-1 |
| Ubuntu 22.04 LTS | python-cryptography | 3.4.8-1ubuntu2.3 | USN-8087-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | python-cryptography | 2.8-3ubuntu0.3+esm2 | USN-8087-3 |
| Ubuntu Pro 18.04 LTS | python-cryptography | 2.1.4-1ubuntu1.4+esm3 | USN-8087-3 |
| Ubuntu Pro 16.04 LTS | python-cryptography | 1.2.3-1ubuntu0.3+esm3 | USN-8087-3 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | fence-virt +56 | 4.10.0-98.el9_7.12 | RHSA-2026:19355, RHSA-2026:13672 |
| RHEL 8 | fence-agents +48 | 4.2.1-129.el8_10.25 | RHSA-2026:12176 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.6 EUS | fence-virt +56 | 4.10.0-86.el9_6.16 | RHSA-2026:21431 |
| RHEL 9.4 EUS | fence-virt +56 | 4.10.0-62.el9_4.24 | RHSA-2026:21517 |
| RHEL 9.2 E4S | fence-virt +56 | 4.10.0-43.el9_2.21 | RHSA-2026:22330 |
| Red Hat Hardened Images 1 | python-cryptography | 46.0.7-1.hum1 | RHSA-2026:7295 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.4-2.el8ap | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.4-2.el8ap | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.6.28-3.el8ap | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy +1 | 2.5.10-5.el8ap | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server +11 | 2.5.20260422-2.el8ap | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | python3.12-jwcrypto | 1.5.7-1.el8ap | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | python3.12-markdown | 3.10.2-1.el8ap | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyOpenSSL | 26.0.0-1.el8ap | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyasn1 | 0.6.3-1.el8ap | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.12.1-1.el8ap | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.4-2.el8ap | RHSA-2026:13512 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | fence-agents-all +47 | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | fence-agents | 4.10.0-98.el9_7.12 | RLSA-2026:19355, RLSA-2026:13672 |
| Rocky Linux 8 | fence-agents | 4.2.1-129.el8_10.25 | RLSA-2026:12176 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-cryptography | 44.0.3-160000.3.1 | SUSE-SU-2026:21165-1 |
| SLES 16.0 | python-cryptography | 44.0.3-160000.3.1 | SUSE-SU-2026:21165-1 |
| SLE Micro 6.2 | python-cryptography | 44.0.3-160000.3.1 | SUSE-SU-2026:21021-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | python-cryptography | 42.0.4-slfo.1.1_3.1 | SUSE-SU-2026:20655-1 |
| SLE Micro 6.0 | python-cryptography | 42.0.4-3.1 | SUSE-SU-2026:20706-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | oci-cli | 3.76.2-1.1 | openSUSE-SU-2026:10539-1 |
| openSUSE Tumbleweed | python-cryptography | 46.0.5-1.1 | openSUSE-SU-2026:10205-1 |
| openSUSE Leap 16.0 | python-cryptography | 44.0.3-160000.3.1 | openSUSE-SU-2026:20506-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-cryptography | 46.0.5-r0 | — |
| Alpine v3.23 | py3-cryptography | 46.0.5-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-cryptography | 42.0.5-4 | — |
| Azure Linux 2 (CBL-Mariner) | python-cryptography | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | fence-virt +54 | 4.10.0-98.el9_7.12 | ELSA-2026-19355, ELSA-2026-13672 |
| Oracle Linux 8 | fence-agents-all +41 | 4.2.1-129.el8_10.25 | ELSA-2026-12176 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.1.7-r1 | — |
| Wolfi rolling | dask-kubernetes | 2025.7.0-r8 | — |
| Wolfi rolling | datadog-agent-7.72-core-integrations | 7.72.4-r27 | — |
| Wolfi rolling | datadog-agent-7.73-core-integrations | 7.73.3-r23 | — |
| Wolfi rolling | ggshield | 1.49.0-r1 | — |
| Wolfi rolling | in-toto | 3.0.0-r3 | — |
| Wolfi rolling | jupyter-base-notebook | 7.5.3-r2 | — |
| Wolfi rolling | k8s-sidecar | 2.5.1-r1 | — |
| Wolfi rolling | kserve-storage-controller | 0.16.0-r13 | — |
| Wolfi rolling | kubeflow-jupyter-web-app | 1.10.0-r12 | — |
| Wolfi rolling | kubeflow-pipelines-apiserver | 2.15.0-r12 | — |
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.15.0-r5 | — |
| Wolfi rolling | kubeflow-volumes-web-app | 1.10.0-r11 | — |
| Wolfi rolling | mitmproxy | 12.2.1-r0 | — |
| Wolfi rolling | open-webui | 0.8.3-r0 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.27.0-r4 | — |
| Wolfi rolling | py3-semgrep | 1.152.0-r0 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cryptography | < 46.0.5 | 46.0.5 | GHSA-r6ph-v2qm-q3c2 |
Advisories 30
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-0935 Red Hat Ansible Automation Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- WID-SEC-2026-2933 Splunk SOAR: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2026:12176 Important: fence-agents security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-8087-1 python-cryptography vulnerability Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-8087-3 python-cryptography vulnerability Ubuntu Security Notices (USN) · Oct 27, 2026
- RHSA-2026:7295 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:22330 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:21431 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:21517 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:19355 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:13672 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:13512 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:12176 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-2451 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 2, 2026
- ELSA-2026-19355 Important: fence-agents security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 26, 2026
- RLSA-2026:19355 Important: fence-agents security update Rocky Linux Security Advisories · May 30, 2026
- RLSA-2026:13672 Important: fence-agents security update Rocky Linux Security Advisories · May 6, 2026
- ELSA-2026-13672 Important: fence-agents security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 6, 2026
- RLSA-2026:12176 Important: fence-agents security update Rocky Linux Security Advisories · Apr 30, 2026
- ELSA-2026-12176 Important: fence-agents security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 30, 2026
- openSUSE-SU-2026:20506-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21165-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Apr 22, 2026
- WID-SEC-2026-1198 Oracle Database Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- SUSE-SU-2026:21021-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Apr 14, 2026
- openSUSE-SU-2026:10539-1 oci-cli-3.76.2-1.1 on GA media SUSE / openSUSE Security Updates · Apr 14, 2026
- openSUSE-SU-2026:10205-1 python311-cryptography-46.0.5-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20706-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20655-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Mar 23, 2026