GHSA-G6CJ-PR64-35W5 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

🗓️ 03 Aug 2026 21:17:00Reported by GoogleType

osv🔗 osv.dev👁 5 Views

PKCS#7 EnvelopedData decryption leaks a Bleichenbacher oracle via error and timing differences; fix uses RFC 3218 to uniform failures.

Reporter	Title	Published	Views	Family All 43
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL	7 Aug 202614:04	–	ibm
ATTACKERKB	CVE-2026-69247	3 Aug 202621:16	–	attackerkb
BDU FSTEC	The vulnerabilities of the functions pkcs7_decrypt_smime(), pkcs7_decrypt_pem(), and pkcs7_decrypt_der in the Python programming language-based cryptography library allow attackers to compromise the confidentiality of protected information.	5 Aug 202600:00	–	bdu_fstec
Chainguard	CVE-2026-69247 vulnerabilities	4 Aug 202620:23	–	cgr
Circl	CVE-2026-69247	4 Aug 202600:32	–	circl
CVE	CVE-2026-69247	3 Aug 202621:16	–	cve
Cvelist	CVE-2026-69247 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing	3 Aug 202621:16	–	cvelist
Debian CVE	CVE-2026-69247	3 Aug 202621:16	–	debiancve
EUVD	EUVD-2026-52446	3 Aug 202621:16	–	euvd
Github Security Blog	cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing	3 Aug 202621:17	–	github

Source	Link
github	www.github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5
github	www.github.com/pyca/cryptography/pull/15369
github	www.github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f
github	www.github.com/pyca/cryptography

04 Aug 2026 21:26Current

5.5Medium risk

Vulners AI Score5.5

CVSS 48.2

EPSS0.00175