PyCA cryptography 46.0.7 released, fixes CVE-2026-39892

[Alan Coopersmith <alan.coopersmith () oracle com>]

-------- Forwarded Message --------
Subject: [Python-announce] PyCA cryptography 46.0.7 released
Date: Tue, 7 Apr 2026 21:10:55 -0500
From: Paul Kehrer via Python-announce-list <python-announce-list () python org>
Reply-To: python-list () python org
To: python-announce-list () python org, cryptography-dev () python org
CC: Paul Kehrer <paul.l.kehrer () gmail com>

PyCA cryptography 46.0.7 has been released to PyPI. cryptography includes
both high level recipes and low level interfaces to common
cryptographic algorithms
such as symmetric ciphers, asymmetric algorithms, message digests, X.509,
key derivation functions, and much more. We support Python 3.8+, and PyPy3
3.11.

Changelog (https://cryptography.io/en/latest/changelog/#v46-0-7)
* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
passed to APIs that accept Python buffers, which could lead to buffer
overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL
3.5.6.

-Paul Kehrer (reaperhulk)
_______________________________________________
Python-announce-list mailing list -- python-announce-list () python org
To unsubscribe send an email to python-announce-list-leave () python org
https://mail.python.org/mailman3//lists/python-announce-list.python.org



https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq
provides the additional info:

Package: cryptography (pip)
Affected versions: >= 45.0.0, < 46.0.7
Patched versions: 46.0.7

Description:

If a non-contiguous buffer was passed to APIs which accepted Python buffers 
(e.g. Hash.update()), this could lead to buffer overflows. For example:

   h = Hash(SHA256())
   b.update(buf[::-1])

would read past the end of the buffer on Python >3.11