CVE-2023-38325

CVE-2023-38325 : The cryptography package (Python) before 41.0.2 mishandles SSH certificates with critical options. Public IBM/IBM Cloud Pak for Data System 2.0 advisories confirm this CVE applies to IBM Cloud Pak for Data System 2.0 (versions 2.0.0.0–2.0.2.1.IF2) and that a security patch is ava...

CVE-2020-36242

The CVE refers to the Python cryptography package prior to 3.3.2. The issue arises from certain sequences of update() calls when symmetrically encrypting very large (multi-GB) payloads, which can trigger an integer overflow and buffer overflow, as demonstrated by the Fernet class. This affects cr...

CVE-2024-26130

CVE-2024-26130 — cryptography (Python) : A NULL pointer dereference occurs when calling pkcs12.serialize_key_and_certificates with a certificate public key that does not match the provided private key and an encryption_algorithm with hmac_hash. Versions 38.0.0–42.0.3 are affected; the issue crash...

CVE-2023-50782

CVE-2023-50782 affects the python-cryptography library across multiple Linux distributions. The underlying issue is a Bleichenbacher timing/PKCS#1 v1.5 RSA decryption handling flaw that could allow a remote attacker to decrypt TLS RSA-exchange messages, potentially exposing confidential data. Aff...

CVE-2020-25659

CVE-2020-25659 affects python-cryptography 3.2, with a Bleichenbacher timing attack against the RSA decryption API (processing of valid PKCS#1 v1.5 ciphertext). Multiple connected advisories confirm the same issue and point to updated/ patched releases (e.g., python-cryptography 3.2.1 in AlmaLinu...

CVE-2023-49083

The CVE-2023-49083 issue affects the Python package cryptography, where calling load_pem_pkcs7_certificates or load_der_pkcs7_certificates can trigger a NULL dereference and segfault, leading to potential DoS during PKCS7 deserialization. Affected software is the Python cryptography library; impa...

CVE-2023-23931

CVE-2023-23931 affects the Python cryptography package. The Cipher.update_into function could accept objects implementing the buffer protocol that were immutable, potentially mutating immutable buffers (e.g., bytes) and producing corrupted output. The issue is addressed by raising an exception an...

CVE-2016-9243

CVE-2016-9243 affects the python-cryptography HKDF implementation. The vulnerability is that HKDF in cryptography before 1.5.2/1.5.3 returns an empty byte-string when used with a length shorter than algorithm.digest_size. Public-era advisories (Ubuntu USN-3138-1, Fedora FEDORA-2016-d3a2b640ce, De...

CVE-2026-26007

CVE-2026-26007 describes a vulnerability in the cryptography package where public_key_from_numbers, EllipticCurvePublicNumbers.public_key(), load_der_public_key(), and load_pem_public_key() do not validate that a key point belongs to the expected prime-order subgroup. This allows small-subgroup k...

CVE-2026-39892

CVE-2026-39892 affects the Python package cryptography. From 45.0.0 to before 46.0.7, passing a non-contiguous buffer to APIs that accept Python buffers (e.g., Hash.update()) could cause buffer overflows. The issue is fixed in version 46.0.7. Remediation: upgrade to cryptography 46.0.7 or later.

CVE-2026-34073

CVE-2026-34073 affects the Python cryptography package. Before 46.0.6, DNS name constraints were validated only against SANs in child certificates, not the peer name presented during validation, allowing a peer with a name like bar.example.com to validate against a wildcard certificate for *.exam...