# cryptography (PyPI) vulnerabilities 18 known vulnerabilities (8 high, 5 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 50.0.2 (Sep 30, 2026): no advisory affects it - Newest unaffected release: 50.0.2 (Sep 30, 2026), the latest release - Weekly downloads: 320.4M - Dependents: 86.5K - Releases: 160 since 0.1.0 (Jan 8, 2014) - Registry: https://pypi.org/project/cryptography/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-69249: 0.1.0 to 48.0.1 (49.0.0 is outside it) - CVE-2026-69248: 0.1.0 to 48.0.1 (49.0.0 is outside it) - CVE-2026-69247: 44.0.0 to 49.0.0 (50.0.0 is outside it) - CVE-2026-39892: 45.0.0 to 46.0.6 (46.0.7 is outside it) - CVE-2026-34073: 0.1.0 to 46.0.5 (46.0.6 is outside it) - CVE-2026-26007: 0.1.0 to 46.0.4 (46.0.5 is outside it) - CVE-2024-12797: 42.0.0 to 44.0.0 (44.0.1 is outside it) - CVE-2024-26130: 0.1.0 to 0.2.0 (0.2.1 is outside it); 0.3.0 to 0.5.1 (0.5.2 is outside it); 0.6.0 (0.6.1 is outside it); 0.7.0 (0.7.1 is outside it); 0.8.0 (0.8.1 is outside it); 0.9.0 (0.9.1 is outside it); 1.0.0 (1.0.1 is outside it); 1.1.0 (1.1.1 is outside it); 1.2.0 (1.2.1 is outside it); 1.3.0 (1.3.1 is outside it); 1.4.0 to 1.5.0 (1.5.1 is outside it); 1.6.0 to 1.7.0 (1.7.1 is outside it); 1.8.0 (1.8.1 is outside it); 1.9.0 to 2.0.0 (2.0.1 is outside it); 2.1.0 (2.1.1 is outside it); 2.2.0 (2.2.1 is outside it); 2.3.0 (2.3.1 is outside it); 2.4.0 to 2.4.1 (2.4.2 is outside it); 2.5.0 to 2.9.0 (2.9.1 is outside it); 3.0.0 to 3.1.0 (3.1.1 is outside it); 3.2.0 (3.2.1 is outside it); 3.3.0 (3.3.1 is outside it); 3.4.0 (3.4.1 is outside it); 35.0.0 to 36.0.0 (36.0.1 is outside it); 37.0.0 (37.0.1 is outside it); 38.0.0 to 42.0.3 (42.0.4 is outside it) - CVE-2023-50782: 0.1.0 to 41.0.7 (42.0.0 is outside it) - CVE-2024-0727: 0.1.0 to 42.0.1 (42.0.2 is outside it) - CVE-2023-49083: 3.1.0 to 41.0.5 (41.0.6 is outside it) - CVE-2023-38325: 40.0.0 to 41.0.1 (41.0.2 is outside it) - CVE-2023-0286: 0.8.1 to 39.0.0 (39.0.1 is outside it) - CVE-2023-23931: 1.8.0 to 39.0.0 (39.0.1 is outside it) - CVE-2020-36242: 3.1.0 to 3.3.1 (3.3.2 is outside it) - CVE-2020-25659: 0.1.0 to 3.2.0 (3.2.1 is outside it) - CVE-2018-10903: 1.9.0 to 2.2.2 (2.3.0 is outside it) - CVE-2016-9243: 0.1.0 to 1.5.2 (1.5.3 is outside it) ## Advisories (18) ### [CVE-2026-69249](https://cve.now/CVE-2026-69249): python-cryptography: Duplicate self-signed intermediates can cause exponential path-building - Severity: High 8.7 - Published: Aug 3, 2026 - Affected: fixed in 49.0.0; from 42.0.0, fixed in 49.0.0. - Fixed in 49.0.0 (released Jun 12, 2026, 52 days before disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2026-69248](https://cve.now/CVE-2026-69248): python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees - Severity: Medium 6.9 - Published: Aug 3, 2026 - Affected: from 45.0.0, fixed in 49.0.0; fixed in 49.0.0. - Fixed in 49.0.0 (released Jun 12, 2026, 52 days before disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2026-69247](https://cve.now/CVE-2026-69247): cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing - Severity: High 8.2 - Published: Aug 3, 2026 - Affected: from 44.0.0, fixed in 50.0.0. - Fixed in 50.0.0 (released Jul 31, 2026, 3 days before disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2026-39892](https://cve.now/CVE-2026-39892): cryptography has a buffer overflow if non-contiguous buffers were passed to APIs - Severity: Medium 6.9 - Published: Apr 8, 2026 - Affected: from 45.0.0, fixed in 46.0.7. - Fixed in 46.0.7 (released Apr 8, 2026, the day of disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2026-34073](https://cve.now/CVE-2026-34073): cryptography has incomplete DNS name constraint enforcement on peer names - Severity: Low 1.7 - Published: Mar 31, 2026 - Affected: fixed in 46.0.6. - Fixed in 46.0.6 (released Mar 25, 2026, 6 days before disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2026-26007](https://cve.now/CVE-2026-26007): cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves - Severity: High 8.2 - Published: Feb 10, 2026 - Affected: fixed in 46.0.5. - Fixed in 46.0.5 (released Feb 10, 2026, the day of disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2024-12797](https://cve.now/CVE-2024-12797): RFC7250 handshakes with unauthenticated servers don't abort as expected - Severity: High 7.4 - Published: Feb 11, 2025 - Affected: from 42.0.0, fixed in 44.0.1. - Fixed in 44.0.1 (released Feb 11, 2025, the day of disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2024-26130](https://cve.now/CVE-2024-26130): cryptography NULL pointer deference with pkcs12.serialize\_key\_and\_certificates when called with a non-matching certificate and private key… - Severity: High 7.5 - Published: Feb 21, 2024 - Affected: from 38.0.0, fixed in 42.0.4; from 38.0.0, fixed in 42.0.4. - Fixed in 42.0.4 (released Feb 21, 2024, the day of disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2023-50782](https://cve.now/CVE-2023-50782): Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659 - Severity: High 7.5 - Published: Feb 5, 2024 - Affected: fixed in 42.0.0. - Fixed in 42.0.0 (released Jan 23, 2024, 13 days before disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2024-0727](https://cve.now/CVE-2024-0727): PKCS12 Decoding crashes - Severity: Medium 5.5 - Published: Jan 26, 2024 - Affected: fixed in 42.0.2. - Fixed in 42.0.2 (released Jan 30, 2024, 4 days after disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2023-49083](https://cve.now/CVE-2023-49083): cryptography vulnerable to NULL-dereference when loading PKCS7 certificates - Severity: Medium 5.9 - Published: Nov 29, 2023 - Affected: from 3.1, fixed in 41.0.6. - Fixed in 41.0.6 (released Nov 27, 2023, 2 days before disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2023-38325](https://cve.now/CVE-2023-38325): The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. - Severity: Unrated - Published: Jul 14, 2023 - Affected: from 40.0.0, fixed in 41.0.2. - Fixed in 41.0.2 (released Jul 11, 2023, 3 days before disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2023-0286](https://cve.now/CVE-2023-0286): X.400 address type confusion in X.509 GeneralName - Severity: High 7.4 - Published: Feb 8, 2023 - Affected: from 0.8.1, fixed in 39.0.1. - Fixed in 39.0.1 (released Feb 7, 2023, 1 day before disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2023-23931](https://cve.now/CVE-2023-23931): Cipher.update\_into can corrupt memory in pyca cryptography - Severity: Medium 4.8 - Published: Feb 7, 2023 - Affected: from 1.8, fixed in 39.0.1. - Fixed in 39.0.1 (released Feb 7, 2023, the day of disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2020-36242](https://cve.now/CVE-2020-36242): In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could… - Severity: Unrated - Published: Feb 7, 2021 - Affected: from 3.1, fixed in 3.3.2. - Fixed in 3.3.2 (released Feb 7, 2021, the day of disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2020-25659](https://cve.now/CVE-2020-25659): python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1… - Severity: Unrated - Published: Jan 11, 2021 - Affected: fixed in 3.2.1; fixed in 3.2. - Fixed in 3.2.1 (released Oct 28, 2020, 75 days before disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2018-10903](https://cve.now/CVE-2018-10903): A flaw was found in python-cryptography versions between \>=1.9.0 and \<2.3. - Severity: High 7.5 - Published: Jul 30, 2018 - Affected: from 1.9.0, fixed in 2.3; from 1.9, fixed in 2.3. - Fixed in 2.3.0 (released Jul 18, 2018, 12 days before disclosure). - The latest release, 50.0.2, is not affected. ### [CVE-2016-9243](https://cve.now/CVE-2016-9243): HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest\_size. - Severity: Unrated - Published: Mar 27, 2017 - Affected: fixed in 1.5.3. - Fixed in 1.5.3 (released Nov 6, 2016, 141 days before disclosure). - The latest release, 50.0.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/cryptography Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.