CVE-2026-39892

🗓️ 08 Apr 2026 20:49:41Reported by GitHub_MType

CVE-2026-39892: cryptography buffer overflow with non-contiguous buffers in Hash.update; fixed in 46.0.7.

Reporter	Title	Published	Views	Family All 60
IBM Security Bulletins	Security Bulletin: Storage Virtualize Ansible Collection is affected by a vulnerability in the cryptography package	21 May 202612:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in cryptography-46.0.3-cp311-abi3-macosx_10_9_universal2.whl	13 May 202603:59	–	ibm
IBM Security Bulletins	Security Bulletin: Location Service for ESRI Component uses cryptography-46.0.6, pyasn1-0.6.2, requests-2.32.5 and cryptography-46.0.5 library which were vulnerable to multiple CVEs	5 May 202603:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.whl, cryptography-46.0.6-cp311-abi3-manylinux_2_34_x86_64.whl which is vulnerable to CVE-2026-34073, CVE-2026-39892	29 May 202610:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands are vulnerable to loss of confidentiality (CVE-2026-39892, CVE-2026-34073) and arbitrary code execution (CVE-2026-40087)	7 May 202613:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	7 May 202613:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Scheduler Optimizer uses cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.wh which is vulnerable to CVE-2026-34073	7 May 202613:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Predict Component uses cryptography-46.0.6-cp311-abi3-manylinux_2_34_x86_64.whl which is vulnerable to CVE-2026-39892	1 May 202614:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.whl, cryptography-46.0.6-cp311-abi3-manylinux_2_34_x86_64.whl which is vulnerable to CVE-2026-34073, CVE-2026-39892	1 Jun 202607:32	–	ibm
IBM Security Bulletins	Security Bulletin: z/Transaction Processing Facility is affected by a vulnerability in the cryptography package (CVE-2026-39892)	22 May 202613:05	–	ibm

NVD

Vulners

Node

cryptography.io cryptographyRange45.0.0–46.0.7python

[
  {
    "vendor": "pyca",
    "product": "cryptography",
    "versions": [
      {
        "version": ">= 45.0.0, < 46.0.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq
openwall	www.openwall.com/lists/oss-security/2026/04/08/12

15 Apr 2026 16:12Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.19.8

CVSS 46.9

EPSS0.00023

CWE-119