Skip to content
Fencer Vulns
high 7.3

CVE-2026-39892 json

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

published 2026-04-08 7 mo ago modified 2026-11-04 5 d ago also EUVD-2026-20640 , GHSA-p423-j2cm-9vmq , PYSEC-2026-36

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

Patch / fix

  • pypi cryptography 46.0.7
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.29-2.el8ap, 0:46.0.7-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.29-2.el9ap, 0:46.0.7-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:4.7.12-1.el9ap, 0:46.0.7-1.el9ap
  • Red Hat Red Hat AI Inference Server 3.3 1782352847, 1782353093
  • Red Hat Red Hat Ansible Automation Platform 2.6 1779734628, 1779759716, 1779760844, 1779761061, 1779762270, 1779773804
  • Red Hat Red Hat Discovery 2 1779395228
  • Red Hat Red Hat Enterprise Linux AI 3.3 1784669680, 1784670204, 1784736798, 1784736822, 1784736857, 1784736941, 1785163184
  • Red Hat Red Hat Hardened Images 46.0.7-1.hum1
  • Red Hat Red Hat OpenShift AI 2.25 1780069069, 1783701598
  • Red Hat Red Hat OpenShift AI 3.3 1782471587, 1782471606, 1782472374
  • Red Hat Red Hat Quay 3.10 1779822261
  • Red Hat Red Hat Quay 3.12 1779811412
  • Red Hat Red Hat Quay 3.14 1779689392
  • Red Hat Red Hat Quay 3.15 1780891395
  • Red Hat Red Hat Quay 3.16 1779204086
  • Red Hat Red Hat Quay 3.17 1779922205
  • Red Hat Red Hat Quay 3.9 1779811473
  • Red Hat Red Hat Trusted Artifact Signer 1.4 1780914886
  • python-cryptography Debian 14 46.0.7-1

debian advisories DEBIAN-CVE-2026-39892

  • receptor ansible automation platform 2.6 1.6.5-1.el10ap
  • receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.5-1.el9ap
  • receptorctl ansible automation platform 2.6 1.6.5-1.el10ap
  • receptorctl ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.5-1.el9ap
  • python3-click ansible automation platform developer 2.6, ansible automation platform 2.6 8.3.3-1.el10ap
  • python3.12-click ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 8.3.3-1.el9ap
  • python3.12-pillow ansible automation platform 2.6, ansible automation platform 2.5 12.2.0-1.el9ap
  • automation-controller ansible automation platform developer 2.6, ansible automation platform 2.6 4.7.12-1.el9ap

red hat advisories RHSA-2026:24762RHSA-2026:24761RHSA-2026:7295

  • python-cryptography openSUSE Tumbleweed 46.0.7-1.1

opensuse advisories openSUSE-SU-2026:10535-1

  • py3-cryptography Alpine 3.24, Alpine 3.23 46.0.7-r0

alpine advisories ALPINE-CVE-2026-39892

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-39892 updated cvss 7.3

cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API

  • Red Hat Lightspeed Core openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9, redhat-user-workloads/lightspeed-core-tenant/lightspeed-stack
    affected: workaround, no fix available
  • Red Hat Migration Toolkit for Applications 8 redhat-user-workloads/ocp-art-tenant/art-images
    affected: workaround, no fix planned “Will not fix”
  • Red Hat AI Inference Server redhat-user-workloads/ai-tenant/rhaiis-3-3/rhaiis-cpu-ubi9-3-3, redhat-user-workloads/ai-tenant/rhaiis-3-3/rhaiis-tpu-ubi9-3-3, redhat-user-workloads/ai-tenant/rhaiis-3-3/rhaiis-cuda-ubi9-3-3, redhat-user-workloads/ai-tenant/rhaiis-3-3/rhaiis-rocm-ubi9-3-3
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/lightspeed-chatbot-rhel8, redhat-user-workloads/es-team-tenant/automation-reports, redhat-user-workloads/ansible-tenant/ansible-automation-platform-26/hub-rhel9, redhat-user-workloads/ansible-tenant/ansible-automation-platform-26/gateway-rhel9, redhat-user-workloads/ansible-tenant/ansible-automation-platform-26/mcp-tools-rhel9, redhat-user-workloads/ansible-tenant/ansible-automation-platform-26/controller-rhel9, +4 more Red Hat Ansible Automation Platform Ansible Core 2 redhat-user-workloads/ansible-ees-tenant/ee-minimal-ansible-core-2-19-rhel-8-tech-preview, redhat-user-workloads/ansible-ees-tenant/ee-minimal-ansible-core-2-19-rhel-9-tech-preview, redhat-user-workloads/ansible-ees-tenant/ee-minimal-ansible-core-2-20-rhel-8-tech-preview, redhat-user-workloads/ansible-ees-tenant/ee-minimal-ansible-core-2-20-rhel-9-tech-preview Red Hat Discovery 2 redhat-user-workloads/discovery-tenant/discovery/discovery-server Red Hat Enterprise Linux 8 fence-agents, fence-agents-all, fence-agents-apc, fence-agents-aws, fence-agents-eps, fence-agents-gce, +43 more Red Hat Enterprise Linux 9 fence-virt, fence-virtd, fence-agents, fence-virtd-cpg, fence-virtd-tcp, fence-agents-all, +51 more Red Hat Enterprise Linux AI (RHEL AI) 3 redhat-user-workloads/rhel-ai-tenant/rhelai-bootc-3-3/bootc-cuda-aws-3-3, redhat-user-workloads/rhel-ai-tenant/rhelai-bootc-3-3/bootc-cuda-gcp-3-3, redhat-user-workloads/rhel-ai-tenant/rhelai-bootc-3-3/bootc-cuda-azure-3-3, redhat-user-workloads/rhel-ai-tenant/rhelai-bootc-3-3/bootc-rocm-azure-3-3
    +1 more products
    Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-kserve-storage-initializer-rhel9, rhoai/odh-training-cuda128-torch29-py312-rhel9, rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9, +15 more
    affected: workaround, no fix available
  • Red Hat Quay 3 redhat-user-workloads/quay-eng-tenant/quay-quay-v3-9, redhat-user-workloads/quay-eng-tenant/quay-quay-v3-10, redhat-user-workloads/quay-eng-tenant/quay-quay-v3-12, redhat-user-workloads/quay-eng-tenant/quay-quay-v3-13, redhat-user-workloads/quay-eng-tenant/quay-quay-v3-14, redhat-user-workloads/quay-eng-tenant/quay-quay-v3-15, +2 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Satellite 6 satellite/foreman-mcp-server-rhel9, redhat-user-workloads/insights-management-tenant/iop-advisor-engine/iop-advisor-engine Red Hat Trusted Artifact Signer securesign/model-transparency
    affected: workaround, no fix available
  • Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1782352847, rhaiis/vllm-rocm-rhel9 1782353093
    fixed: vendor fix RHSA-2026:30089
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-cryptography 46.0.7-1.el8ap, automation-controller-venv-tower 4.6.29-2.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-cryptography 46.0.7-1.el9ap, automation-controller-venv-tower 4.6.29-2.el9ap
    fixed: vendor fix RHSA-2026:24761
show 16 more
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1779761061, ansible-automation-platform-26/gateway-rhel9 1779773804, ansible-automation-platform-26/controller-rhel9 1779762270, ansible-automation-platform-26/ee-supported-rhel9 1779734628, ansible-automation-platform-26/eda-controller-rhel9 1779759716, ansible-automation-platform-tech-preview/metrics-service-rhel9 1779760844
    fixed: vendor fix RHSA-2026:24866
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller 4.7.12-1.el9ap, python3.12-cryptography 46.0.7-1.el9ap, automation-controller-ui 4.7.12-1.el9ap, automation-controller-cli 4.7.12-1.el9ap, automation-controller-server 4.7.12-1.el9ap, automation-controller-venv-tower 4.7.12-1.el9ap
    fixed: vendor fix RHSA-2026:24762
  • Red Hat Discovery 2 discovery 1779395228
    fixed: vendor fix RHSA-2026:20338
  • Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-cuda-rhel9 1784669680, rhelai3/bootc-rocm-rhel9 1784670204, rhelai3/bootc-aws-cuda-rhel9 1784736857, rhelai3/bootc-gcp-cuda-rhel9 1784736941, rhelai3/disk-image-cuda-rhel9 1785163184, rhelai3/bootc-azure-cuda-rhel9 1784736798, +1 more
    fixed: vendor fix RHSA-2026:43855
  • Red Hat Hardened Images python-cryptography 46.0.7-1.hum1
    fixed: vendor fix RHSA-2026:7295
  • Red Hat OpenShift AI 2.25 rhoai/odh-vllm-gaudi-rhel9 1780069069, rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-llama-stack-core-rhel9 1783701598
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.3 rhoai/odh-llama-stack-core-rhel9 1782471587, rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 1782472374, rhoai/odh-trustyai-nemo-guardrails-server-rhel9 1782471606
    fixed: vendor fix RHSA-2026:37275
  • Red Hat Quay 3.9 quay/quay-rhel8 1779811473
    fixed: vendor fix RHSA-2026:23361
  • Red Hat Quay 3.10 quay/quay-rhel8 1779822261
    fixed: vendor fix RHSA-2026:22840
  • Red Hat Quay 3.12 quay/quay-rhel8 1779811412
    fixed: vendor fix RHSA-2026:22629
  • Red Hat Quay 3.14 quay/quay-rhel8 1779689392
    fixed: vendor fix RHSA-2026:21017
  • Red Hat Quay 3.15 quay/quay-rhel8 1780891395
    fixed: vendor fix RHSA-2026:24853
  • Red Hat Quay 3.16 quay 1779204086
    fixed: vendor fix RHSA-2026:19375
  • Red Hat Quay 3.17 quay/quay-rhel9 1779922205
    fixed: vendor fix RHSA-2026:22465
  • Red Hat Trusted Artifact Signer 1.4 rhtas/model-transparency-rhel9 1780914886
    fixed: vendor fix RHSA-2026:24483
  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed/lightspeed-service-api-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/lightspeed-rhel8-operator, ansible-automation-platform-26/lightspeed-rhel9-operator, redhat-user-workloads/ansible-tenant/ansible-automation-platform-26/lightspeed-chatbot-rhel9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.5-1.el8ap, receptorctl 1.6.5-1.el8ap, automation-hub 4.10.15-1.el8ap, python3.12-click 8.3.3-1.el8ap, python3.12-pillow 12.2.0-1.el8ap, python3.12-pulpcore 3.49.61-1.el8ap, +11 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.5-1.el9ap, receptorctl 1.6.5-1.el9ap, automation-hub 4.10.15-1.el9ap, python3.12-click 8.3.3-1.el9ap, python3.12-pillow 12.2.0-1.el9ap, python3.12-pulpcore 3.49.61-1.el9ap, +11 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-web-rhel9 1779765164, ansible-automation-platform-26/receptor-rhel9 1779770938, ansible-automation-platform-26/mcp-tools-rhel9 1779772877, ansible-automation-platform-26/de-minimal-rhel9 1779774688, ansible-automation-platform-26/ee-minimal-rhel9 1779729697, ansible-automation-platform-26/lightspeed-rhel9 1779784904, +18 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.5-1.el9ap, molecule 26.4.0-2.el9ap, receptorctl 1.6.5-1.el9ap, ansible-sign 0.1.5-1.el9ap, ansible-lint 26.4.0-1.el9ap, automation-hub 4.11.9-1.el9ap, +32 more
    +3 more products
    Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.5-1.el10ap, molecule 26.4.0-2.el10ap, receptorctl 1.6.5-1.el10ap, ansible-sign 0.1.5-1.el10ap, python-click 8.3.3-1.el10ap, ansible-lint 26.4.0-1.el10ap, +12 more Red Hat Discovery 2 discovery 1779395188 Red Hat Hardened Images python3-cryptography 46.0.7-1.hum1
    not affected: vulnerable code not present

11 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CISA ADP 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi cryptography
>=45.0.0, <46.0.7
46.0.7

Affected products

  • pyca cryptography
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat AI Inference Server 3.3
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Enterprise Linux AI 3.3
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.14
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.17
  • Red Hat Red Hat Quay 3.9
  • Red Hat Red Hat Trusted Artifact Signer 1.4
  • Red Hat Lightspeed Core
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat OpenShift Lightspeed
  • Red Hat Red Hat AI Inference Server
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform Ansible Core 2
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat Quay 3
  • Red Hat Red Hat Satellite 6

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-131 Incorrect Calculation of Buffer Size

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.