Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

🗓️ 08 Apr 2026 19:23:08Reported by GitHub Advisory DatabaseType

Buffer overflow when noncontiguous buffers are passed to Python buffer APIs such as Hash.update.

Reporter	Title	Published	Views	Family All 60
IBM Security Bulletins	Security Bulletin: Storage Virtualize Ansible Collection is affected by a vulnerability in the cryptography package	21 May 202612:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in cryptography-46.0.3-cp311-abi3-macosx_10_9_universal2.whl	13 May 202603:59	–	ibm
IBM Security Bulletins	Security Bulletin: Location Service for ESRI Component uses cryptography-46.0.6, pyasn1-0.6.2, requests-2.32.5 and cryptography-46.0.5 library which were vulnerable to multiple CVEs	5 May 202603:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.whl, cryptography-46.0.6-cp311-abi3-manylinux_2_34_x86_64.whl which is vulnerable to CVE-2026-34073, CVE-2026-39892	29 May 202610:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands are vulnerable to loss of confidentiality (CVE-2026-39892, CVE-2026-34073) and arbitrary code execution (CVE-2026-40087)	7 May 202613:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	7 May 202613:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Scheduler Optimizer uses cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.wh which is vulnerable to CVE-2026-34073	7 May 202613:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Predict Component uses cryptography-46.0.6-cp311-abi3-manylinux_2_34_x86_64.whl which is vulnerable to CVE-2026-39892	1 May 202614:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.whl, cryptography-46.0.6-cp311-abi3-manylinux_2_34_x86_64.whl which is vulnerable to CVE-2026-34073, CVE-2026-39892	1 Jun 202607:32	–	ibm
IBM Security Bulletins	Security Bulletin: z/Transaction Processing Facility is affected by a vulnerability in the cryptography package (CVE-2026-39892)	22 May 202613:05	–	ibm

Vulners

Node

cryptography py3.10_cryptographyRange45.0.0–46.0.7pip

Source	Link
github	www.github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-39892
openwall	www.openwall.com/lists/oss-security/2026/04/08/12
github	www.github.com/advisories/GHSA-p423-j2cm-9vmq

09 Apr 2026 14:29Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.19.8

CVSS 46.9

EPSS0.00023

CWE-119