by Kastro CVE-2026-39892
pyca cryptography — cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
Description · from the CVE record
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.
Affected
ProductAffectedFixed inSource
cryptography>= 45.0.0, < 46.0.7–CNA
Red Hat Ansible Automation Platform 2.5 for RHEL 8see advisory0:4.6.29-2.el8apredhat-SADP
Red Hat Ansible Automation Platform 2.5 for RHEL 8see advisory0:46.0.7-1.el8apredhat-SADP
Red Hat Ansible Automation Platform 2.5 for RHEL 9see advisory0:4.6.29-2.el9apredhat-SADP
Red Hat Ansible Automation Platform 2.5 for RHEL 9see advisory0:46.0.7-1.el9apredhat-SADP
Red Hat Ansible Automation Platform 2.6 for RHEL 9see advisory0:4.7.12-1.el9apredhat-SADP
Red Hat Ansible Automation Platform 2.6 for RHEL 9see advisory0:46.0.7-1.el9apredhat-SADP
Red Hat AI Inference Server 3.3see advisory1782353093redhat-SADP
Red Hat AI Inference Server 3.3see advisory1782352847redhat-SADP
Red Hat Ansible Automation Platform 2.6see advisory1779762270redhat-SADP
Red Hat Ansible Automation Platform 2.6see advisory1779759716redhat-SADP
Red Hat Ansible Automation Platform 2.6see advisory1779734628redhat-SADP
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
GitHub_M (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial