CVE-2026-39892 is a critical buffer overflow (CVSS 9.8) in the Python cryptography package. From 45.0.0 to before 46.0.7, passing a non-contiguous buffer to APIs that accept Python buffers, such as Hash.update(), could overflow memory. Version 46.0.7 fixes it, so upgrade any environment still on the affected range.
What's affected
cryptography from 45.0.0 up to but not including 46.0.7 is affected. The fixed version is 46.0.7.
Because cryptography sits under many other packages, such as TLS, SSH and token libraries, it is often installed without being named in your requirements file.
How to check if you're exposed
pip show cryptography
pip freeze | grep -i cryptography
pip install pipdeptree && pipdeptree -r -p cryptography
Check containers and virtual environments too. A version from 45.0.0 through 46.0.6 is in range.
What to do now
- Upgrade with
pip install -U cryptographyand confirm 46.0.7 or later. - Rebuild images and lock files that pin an older version.
- Check distribution packages, since vendors such as Red Hat have published errata.
- Add a lock file check to CI so a vulnerable range cannot return.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
The record lists CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-131 (Incorrect Calculation of Buffer Size). Buffer APIs normally assume the memory is contiguous. A non-contiguous view breaks that assumption, and native code that sizes a copy from the wrong length can write past the end of a buffer.
The flaw is in the bridge between Python and native code, where memory safety depends on every caller path being handled. The record does not flag this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I have to call Hash.update() myself?
Not necessarily. Another library may pass a non-contiguous buffer. Upgrade regardless.
What is the fixed version?
cryptography 46.0.7.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
