Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

cryptography

18 known vulnerabilities (8 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
50.0.2 (Sep 30, 2026): no advisory affects it
Newest unaffected release
50.0.2 (Sep 30, 2026), the latest release
Advisories
18 · 8 high, 5 medium, 1 low
Weekly downloads
320.4M
Dependents
86.5K
Releases
160 since 0.1.0 (Jan 8, 2014)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-69249
    Affects 0.1.0 to 48.0.1 (49.0.0 is outside it)
  • CVE-2026-69248
    Affects 0.1.0 to 48.0.1 (49.0.0 is outside it)
  • CVE-2026-69247
    Affects 44.0.0 to 49.0.0 (50.0.0 is outside it)
  • CVE-2026-39892
    Affects 45.0.0 to 46.0.6 (46.0.7 is outside it)
  • CVE-2026-34073
    Affects 0.1.0 to 46.0.5 (46.0.6 is outside it)
  • CVE-2026-26007
    Affects 0.1.0 to 46.0.4 (46.0.5 is outside it)
  • CVE-2024-12797
    Affects 42.0.0 to 44.0.0 (44.0.1 is outside it)
  • CVE-2024-26130
    Affects 0.1.0 to 0.2.0 (0.2.1 is outside it); 0.3.0 to 0.5.1 (0.5.2 is outside it); 0.6.0 (0.6.1 is outside it); 0.7.0 (0.7.1 is outside it); 0.8.0 (0.8.1 is outside it); 0.9.0 (0.9.1 is outside it); 1.0.0 (1.0.1 is outside it); 1.1.0 (1.1.1 is outside it); 1.2.0 (1.2.1 is outside it); 1.3.0 (1.3.1 is outside it); 1.4.0 to 1.5.0 (1.5.1 is outside it); 1.6.0 to 1.7.0 (1.7.1 is outside it); 1.8.0 (1.8.1 is outside it); 1.9.0 to 2.0.0 (2.0.1 is outside it); 2.1.0 (2.1.1 is outside it); 2.2.0 (2.2.1 is outside it); 2.3.0 (2.3.1 is outside it); 2.4.0 to 2.4.1 (2.4.2 is outside it); 2.5.0 to 2.9.0 (2.9.1 is outside it); 3.0.0 to 3.1.0 (3.1.1 is outside it); 3.2.0 (3.2.1 is outside it); 3.3.0 (3.3.1 is outside it); 3.4.0 (3.4.1 is outside it); 35.0.0 to 36.0.0 (36.0.1 is outside it); 37.0.0 (37.0.1 is outside it); 38.0.0 to 42.0.3 (42.0.4 is outside it)
  • CVE-2023-50782
    Affects 0.1.0 to 41.0.7 (42.0.0 is outside it)
  • CVE-2024-0727
    Affects 0.1.0 to 42.0.1 (42.0.2 is outside it)
  • CVE-2023-49083
    Affects 3.1.0 to 41.0.5 (41.0.6 is outside it)
  • CVE-2023-38325
    Affects 40.0.0 to 41.0.1 (41.0.2 is outside it)
Show all 18 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 18

  • python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

    Affected: fixed in 49.0.0; from 42.0.0, fixed in 49.0.0.

    Fixed in 49.0.0 (released Jun 12, 2026, 52 days before disclosure).

    The latest release, 50.0.2, is not affected.

  • CVE-2026-69248Medium 6.9

    python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

    Affected: from 45.0.0, fixed in 49.0.0; fixed in 49.0.0.

    Fixed in 49.0.0 (released Jun 12, 2026, 52 days before disclosure).

    The latest release, 50.0.2, is not affected.

  • cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

    Affected: from 44.0.0, fixed in 50.0.0.

    Fixed in 50.0.0 (released Jul 31, 2026, 3 days before disclosure).

    The latest release, 50.0.2, is not affected.

  • CVE-2026-39892Medium 6.9

    cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

    Affected: from 45.0.0, fixed in 46.0.7.

    Fixed in 46.0.7 (released Apr 8, 2026, the day of disclosure).

    The latest release, 50.0.2, is not affected.

  • cryptography has incomplete DNS name constraint enforcement on peer names

    Affected: fixed in 46.0.6.

    Fixed in 46.0.6 (released Mar 25, 2026, 6 days before disclosure).

    The latest release, 50.0.2, is not affected.

  • cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

    Affected: fixed in 46.0.5.

    Fixed in 46.0.5 (released Feb 10, 2026, the day of disclosure).

    The latest release, 50.0.2, is not affected.

  • RFC7250 handshakes with unauthenticated servers don't abort as expected

    Affected: from 42.0.0, fixed in 44.0.1.

    Fixed in 44.0.1 (released Feb 11, 2025, the day of disclosure).

    The latest release, 50.0.2, is not affected.

  • cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key…

    Affected: from 38.0.0, fixed in 42.0.4; from 38.0.0, fixed in 42.0.4.

    Fixed in 42.0.4 (released Feb 21, 2024, the day of disclosure).

    The latest release, 50.0.2, is not affected.

  • Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659

    Affected: fixed in 42.0.0.

    Fixed in 42.0.0 (released Jan 23, 2024, 13 days before disclosure).

    The latest release, 50.0.2, is not affected.

  • CVE-2024-0727Medium 5.5

    PKCS12 Decoding crashes

    Affected: fixed in 42.0.2.

    Fixed in 42.0.2 (released Jan 30, 2024, 4 days after disclosure).

    The latest release, 50.0.2, is not affected.

  • CVE-2023-49083Medium 5.9

    cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

    Affected: from 3.1, fixed in 41.0.6.

    Fixed in 41.0.6 (released Nov 27, 2023, 2 days before disclosure).

    The latest release, 50.0.2, is not affected.

  • The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.

    Affected: from 40.0.0, fixed in 41.0.2.

    Fixed in 41.0.2 (released Jul 11, 2023, 3 days before disclosure).

    The latest release, 50.0.2, is not affected.

  • X.400 address type confusion in X.509 GeneralName

    Affected: from 0.8.1, fixed in 39.0.1.

    Fixed in 39.0.1 (released Feb 7, 2023, 1 day before disclosure).

    The latest release, 50.0.2, is not affected.

  • CVE-2023-23931Medium 4.8

    Cipher.update_into can corrupt memory in pyca cryptography

    Affected: from 1.8, fixed in 39.0.1.

    Fixed in 39.0.1 (released Feb 7, 2023, the day of disclosure).

    The latest release, 50.0.2, is not affected.

  • In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could…

    Affected: from 3.1, fixed in 3.3.2.

    Fixed in 3.3.2 (released Feb 7, 2021, the day of disclosure).

    The latest release, 50.0.2, is not affected.

Show all 18 advisoriesShow fewer advisories

  • python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1…

    Affected: fixed in 3.2.1; fixed in 3.2.

    Fixed in 3.2.1 (released Oct 28, 2020, 75 days before disclosure).

    The latest release, 50.0.2, is not affected.

  • A flaw was found in python-cryptography versions between >=1.9.0 and <2.3.

    Affected: from 1.9.0, fixed in 2.3; from 1.9, fixed in 2.3.

    Fixed in 2.3.0 (released Jul 18, 2018, 12 days before disclosure).

    The latest release, 50.0.2, is not affected.

  • HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.

    Affected: fixed in 1.5.3.

    Fixed in 1.5.3 (released Nov 6, 2016, 141 days before disclosure).

    The latest release, 50.0.2, is not affected.