VulnerableCode Package Details - pkg:deb/debian/python-cryptography@46.0.6-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-za3q-wwzc-qbgv Aliases: CVE-2026-39892 GHSA-p423-j2cm-9vmq	cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.	46.0.7-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-za3q-wwzc-qbgv
Aliases:
CVE-2026-39892
GHSA-p423-j2cm-9vmq

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.

46.0.7-1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-rgsr-9wpx-qqg6	cryptography has incomplete DNS name constraint enforcement on peer names ## Summary In versions of cryptography prior to 46.0.5, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named `bar.example.com` to validate against a wildcard leaf certificate for `*.example.com`, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for `bar.example.com`. This behavior resulted from a gap between RFC 5280 (which defines Name Constraint semantics) and RFC 9525 (which defines service identity semantics): put together, neither states definitively whether Name Constraints should be applied to peer names. To close this gap, cryptography now conservatively rejects any validation where the peer name would be rejected by a name constraint if it were a SAN instead. In practice, exploitation of this bypass requires an uncommon X.509 topology, one that the Web PKI avoids because it exhibits these kinds of problems. Consequently, we consider this a medium-to-low impact severity. See CVE-2025-61727 for a similar bypass in Go's `crypto/x509`. ## Remediation Users should upgrade to 46.0.6 or newer. ## Attribution Reporter: @1seal	CVE-2026-34073 GHSA-m959-cc7f-wv43

Vulnerability

Summary

Aliases

VCID-rgsr-9wpx-qqg6

cryptography has incomplete DNS name constraint enforcement on peer names ## Summary In versions of cryptography prior to 46.0.5, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named `bar.example.com` to validate against a wildcard leaf certificate for `*.example.com`, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for `bar.example.com`. This behavior resulted from a gap between RFC 5280 (which defines Name Constraint semantics) and RFC 9525 (which defines service identity semantics): put together, neither states definitively whether Name Constraints should be applied to peer names. To close this gap, cryptography now conservatively rejects any validation where the peer name would be rejected by a name constraint if it were a SAN instead. In practice, exploitation of this bypass requires an uncommon X.509 topology, one that the Web PKI avoids because it exhibits these kinds of problems. Consequently, we consider this a medium-to-low impact severity. See CVE-2025-61727 for a similar bypass in Go's `crypto/x509`. ## Remediation Users should upgrade to 46.0.6 or newer. ## Attribution Reporter: @1seal

CVE-2026-34073
GHSA-m959-cc7f-wv43

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T09:09:17.087565+00:00	Debian Importer	Fixing	VCID-rgsr-9wpx-qqg6	https://security-tracker.debian.org/tracker/data/json	38.4.0
2026-04-16T08:59:56.152976+00:00	Debian Importer	Affected by	VCID-za3q-wwzc-qbgv	https://security-tracker.debian.org/tracker/data/json	38.4.0
2026-04-13T06:03:15.177517+00:00	Debian Importer	Fixing	VCID-rgsr-9wpx-qqg6	https://security-tracker.debian.org/tracker/data/json	38.3.0
2026-04-11T18:02:03.840734+00:00	Debian Importer	Affected by	VCID-za3q-wwzc-qbgv	https://security-tracker.debian.org/tracker/data/json	38.3.0
2026-04-10T06:59:18.723354+00:00	Debian Importer	Affected by	VCID-za3q-wwzc-qbgv	https://security-tracker.debian.org/tracker/data/json	38.1.0
2026-04-08T18:40:32.321130+00:00	Debian Importer	Fixing	VCID-rgsr-9wpx-qqg6	https://security-tracker.debian.org/tracker/data/json	38.1.0