Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pyca | cryptography | >= 45.0.0, < 46.0.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-cryptography | 46.0.7-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python-cryptography | 46.0.7-1.hum1 | RHSA-2026:7295 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | receptorctl | 1.6.5-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.12-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | python3-click | 8.3.3-1.el10ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | receptorctl | 1.6.5-1.el9ap | RHSA-2026:24762 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | automation-controller +3 | 4.7.12-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.6.29-2.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy | 2.6.14-3.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-server | 2.5.10-6.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20260422-3.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.9-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3-click | 8.3.3-1.el10ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-pillow | 12.2.0-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | receptorctl | 1.6.5-1.el9ap | RHSA-2026:24762 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-cryptography | 46.0.7-1.1 | openSUSE-SU-2026:10535-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-cryptography | 46.0.7-r0 | — |
| Alpine v3.23 | py3-cryptography | 46.0.7-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.2.0-r1 | — |
| Wolfi rolling | dask-kubernetes | 2026.3.0-r3 | — |
| Wolfi rolling | datadog-agent-7.72-core-integrations | 7.72.4-r27 | — |
| Wolfi rolling | datadog-agent-7.73-core-integrations | 7.73.3-r23 | — |
| Wolfi rolling | ggshield | 1.51.0-r5 | — |
| Wolfi rolling | in-toto | 3.1.0-r0 | — |
| Wolfi rolling | jupyter-base-notebook | 7.5.5-r4 | — |
| Wolfi rolling | k8s-sidecar | 2.6.0-r0 | — |
| Wolfi rolling | kserve-storage-controller | 0.16.0-r25 | — |
| Wolfi rolling | kubeflow-jupyter-web-app | 1.10.0-r15 | — |
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.16.0-r4 | — |
| Wolfi rolling | kubeflow-volumes-web-app | 1.10.0-r16 | — |
| Wolfi rolling | mitmproxy | 12.2.2-r1 | — |
| Wolfi rolling | mycli | 1.68.1-r0 | — |
| Wolfi rolling | open-webui | 0.8.12-r3 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.27.1-r2 | — |
| Wolfi rolling | semgrep | 1.160.0-r0 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cryptography | >= 45.0.0, < 46.0.7 | 46.0.7 | GHSA-p423-j2cm-9vmq |
Advisories 11
- WID-SEC-2026-4090 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-1434 IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- NCSC-2026-0444 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 21, 2026
- RHSA-2026:7295 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:24761 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:24762 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- NCSC-2026-0259 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jul 22, 2026
- NCSC-2026-0256 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jul 22, 2026
- openSUSE-SU-2026:10535-1 python311-cryptography-46.0.7-1.1 on GA media SUSE / openSUSE Security Updates · Apr 12, 2026
References
- https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq
- https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5
- https://github.com/pyca/cryptography/commit/c09d38ae52de7d95fe683b7a7c496f5751616f27
- https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-36.yaml