CVE-2026-39892

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. For example:

h = Hash(SHA256())
b.update(buf[::-1])

would read past the end of the buffer on Python >3.11

Fix available through Seal Security. No upgrade required, protect your application instantly.

Score

6.9

Severity

Medium

Ecosystem

Python

Publish Date

April 8, 2026

Modified Date

June 5, 2026

Score Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Versions