Skip to main content

Python cryptography CVE-2026-26007

HIGH
Insufficient Verification of Data Authenticity (CWE-345)
2026-02-10 security-advisories@github.com GHSA-r6ph-v2qm-q3c2
Python Information Disclosure Cryptography Cryptography Io
8.2
CVSS 4.0 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify victim using SECT-curve ECDH/ECDSA
  2. Delivery
    Craft small-order public-key point
  3. Exploit
    Submit malicious key via load/from_encoded_point
  4. Execution
    Victim computes [d]P without subgroup check
  5. Persist
    Recover private-key bits mod small subgroup
  6. Impact
    Forge ECDSA signatures or derive key

Vulnerability Assessment

Weakness
CWE
CWE-345
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
Exploitation Conditions

Exploitation requires that the victim application use SECT binary elliptic curves (SECT163/233/283/409/571 K1/R1/R2) - not the default and commonly used SECP/prime curves - and that it process an attacker-supplied public key through one of the vulnerable entry points (EllipticCurvePublicNumbers.public_key()/public_key_from_numbers, from_encoded_point, load_der_public_key, or load_pem_public_key) in an ECDH or ECDSA operation. The strongest private-key bit leakage occurs on curves with cofactor greater than 1, exposing the least significant bits of the private key; in ECDSA the same weak keys allow signature forgery within the small subgroup. Limiting factors: only binary curves are affected (vendor states these are rarely used in production), CVSS AC:H reflects that practical key recovery generally needs repeated interactions, and the attacker must be able to feed public-key input into the victim's ECDH/ECDSA path. No special authentication is required (PR:N) and no user interaction is needed (UI:N).
Impact

Signals point to a real but narrow-impact issue rather than a fire drill. The CVSS 4.0 base of 8.2 is driven by high confidentiality impact (VC:H, private-key disclosure) at network reach with no privileges, but is tempered by AC:H, which correctly reflects that exploitation only works against the uncommon SECT binary curves and typically requires repeated interactions to recover key bits. EPSS is essentially zero (0.01%, 0th percentile) and the issue is not on CISA KEV, consistent with no public exploit identified at time of analysis; the GitHub commit ships only negative test vectors (malformed keys that must raise ValueError), not a weaponized attack. The vendor itself notes binary curves are 'rarely used in real-world applications,' so the practical attack surface is small despite the high CVSS confidentiality rating. Net: patch on a normal cadence - this is not an emergency unless you specifically deploy ECDH/ECDSA over SECT curves with externally supplied public keys.
Exploit ScenarioDerived

An application uses cryptography to perform ECDH key agreement over a SECT (binary) curve and loads a peer's public key via load_pem_public_key() or from_encoded_point(); an attacker repeatedly presents crafted small-order points and observes derived behaviour, recovering the victim's private-key bits modulo the small subgroup order. Because the attack vector is network-based but high-complexity and limited to uncommon binary curves, it requires the victim to specifically use SECT curves with attacker-influenced peer keys; only negative test vectors, not a public exploit, exist at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

Private-key information disclosure in the pyca/cryptography Python package (versions <= 46.0.4) arises because public-key loading and construction routines skip prime-order subgroup validation for SECT binary elliptic curves, letting an attacker submit a small-order point that leaks bits of a victim's private key during ECDH or enables signature forgery in ECDSA. Per the CVSS vector exploitation is unauthenticated and network-reachable (PR:N/AV:N) but high-complexity (AC:H), and only the rarely used SECT/binary curves are affected. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and a fix is available in 46.0.5.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 05:45 cvss changed CVSS 8.2

Private-key information disclosure in the Python cryptography package (versions up to and including 46.0.4) arises because public-key loading paths (EllipticCurvePublicNumbers.public_key(), load_der_public_key(), and load_pem_public_key()) fail to validate that a supplied point lies in the curve's prime-order subgroup. An attacker who induces a victim to use an attacker-chosen public key on a binary SECT curve can supply a small-order point and recover the victim's private-key bits via ECDH shared-secret leakage, or forge ECDSA signatures within the small subgroup. Only the rarely used SECT (binary) curves are affected; no public exploit is identified at time of analysis and EPSS is just 0.01%.

v3 Jun 30, 2026 - 05:44 cvss changed CVSS 8.2

Private-key disclosure and signature forgery in the Python 'cryptography' package before 46.0.5 arises because EC public-key loaders (public_key_from_numbers, EllipticCurvePublicNumbers.public_key(), load_der_public_key(), load_pem_public_key()) accept points without checking prime-order subgroup membership, enabling small-subgroup attacks against SECT (binary) curves. An attacker supplying a crafted low-order public key can leak the victim's private key modulo a small subgroup order through ECDH shared-secret computation, or forge ECDSA signatures within the small subgroup. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), the issue is not in CISA KEV, and a vendor patch (46.0.5) is available.

v2 Jun 30, 2026 - 05:44 cvss changed CVSS 8.2

Private-key information disclosure in the Python cryptography package before 46.0.5 arises because EC public-key loaders (load_der_public_key, load_pem_public_key, EllipticCurvePublicNumbers.public_key()) fail to verify that a supplied point lies in the expected prime-order subgroup. An attacker who can feed a crafted small-order public key point can leak the victim's ECDSA/ECDH private-key bits modulo the small subgroup order, and forge ECDSA signatures within that subgroup. Only binary-field SECT curves (cofactor > 1) are affected; the issue is fixed in 46.0.5, has an EPSS of 0.01%, and has no public exploit identified at time of analysis.

v1 Mar 12, 2026 - 22:02 CVSS 6.5

Cryptography versions up to 46.0.5 is affected by insufficient verification of data authenticity (CVSS 6.5).

RemediationAI

Vendor-released patch: 46.0.5 - upgrade the cryptography package to 46.0.5 or later (for example, pin cryptography>=46.0.5 and rebuild/redeploy), which is the primary and complete fix per GHSA-r6ph-v2qm-q3c2 and commit 0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c. On managed distributions, apply the corresponding vendor errata instead (Red Hat RHSA-2026:6308/6309/6404/2694/5665/6568/6497/6567/5168, SUSE-SU-2026:20655/20706). If you cannot upgrade immediately, the effective compensating control is to stop using SECT/binary elliptic curves entirely - the package deprecates them in 46.0.5 and will remove them in the next release - and to avoid loading or accepting externally supplied EC public keys over those curves in ECDH/ECDSA flows; the trade-off is that any system genuinely depending on SECT curves must migrate to prime-field curves (e.g., SECP256R1) before disabling them. Where you control the input path, validate or reject untrusted public keys against the expected prime-order subgroup before use.

Affected Packages

pypi cryptography fix: 46.0.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

cryptography exposes ECC primitives backed by OpenSSL through a Rust binding layer (src/rust/src/backend/ec.rs). The affected APIs - EllipticCurvePublicNumbers.public_key()/public_key_from_numbers, from_encoded_point(), load_der_public_key() and load_pem_public_key() - accepted an elliptic-curve point without confirming it lies in the curve's intended prime-order subgroup, the root-cause class captured by CWE-345 (Insufficient Verification of Data Authenticity). On curves with cofactor greater than 1 (the SECT binary-field curves SECT163K1/R2, SECT233K1/R1, SECT283K1/R1, SECT409K1/R1, SECT571K1/R1), an attacker-supplied small-order point P makes [d]P land in a tiny subgroup, so the result reveals d mod (small_subgroup_order) - classic invalid-curve/small-subgroup behaviour. The fix adds an ECPublicKey::new constructor that calls OpenSSL's check_key() whenever the cofactor is not 1, and additionally deprecates all SECT curves for removal. CPE confirms the affected component is cpe:2.3:a:cryptography.io:cryptography for the Python platform.

Know when Cryptography gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.2 HIGH
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
vuln.today AI 5.3 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N) but high complexity (AC:H) since only uncommon SECT curves are affected and key recovery needs repeated interactions; impact is private-key disclosure (C:H) with no integrity/availability loss.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Red Hat 7.4 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
High
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

8
Analysis Updated
Jun 30, 2026 - 05:46 vuln.today
v5 - CVSS changed
Analysis Updated
Jun 30, 2026 - 05:45 vuln.today
v4 - CVSS changed
Analysis Updated
Jun 30, 2026 - 05:44 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 05:44 vuln.today
v2 - CVSS changed
Severity Changed
Jun 30, 2026 - 03:23 NVD
MEDIUM HIGH
CVSS changed
Jun 30, 2026 - 03:23 NVD
6.5 (MEDIUM) 8.2 (HIGH)
Patch released
Feb 23, 2026 - 15:40 nvd
Patch available
CVE Published
Feb 10, 2026 - 22:17 nvd
MEDIUM 6.5

DescriptionCVE.org

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.

Executive ViewAI

Why It Matters

The pyca/cryptography library used across Python application deployments contains a vulnerability (CVE-2026-26007) in versions up to 46.0.4 that enables private key disclosure and signature forgery on systems using SECT binary elliptic curves. Practical risk is constrained to this rare cryptography subset, requires high attack complexity, and carries negligible real-world exploitation probability (0.01% EPSS). Patching to version 46.0.5 is the immediate priority for any systems using this library.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 100% exploitable
Prevalence
High
foundational Python crypto library, extremely widely deployed across the ecosystem
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:*

More in Cryptography

View all
CVE-2026-69249 HIGH POC
8.7 Aug 03

Certificate path building in python-cryptography before 49.0.0 is exploitable as a denial-of-service vector by attackers
CVE-2026-69247 HIGH POC
8.2 Aug 03

PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle

CVE-2023-38325 HIGH POC
7.5 Jul 14

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. Rated high sev
CVE-2023-49083 HIGH POC
7.5 Nov 29

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Rated high sever
CVE-2026-69248 MEDIUM POC
6.9 Aug 03

Wildcard DNS SAN matching in python-cryptography's X.509 chain verifier prior to 49.0.0 allows a leaf certificate bearin
CVE-2023-23931 MEDIUM POC
6.5 Feb 07

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Rated medium sev
CVE-2016-9243 HIGH
7.5 Mar 27

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size. Ra
CVE-2023-50782 HIGH
7.5 Feb 05

A flaw was found in the python-cryptography package. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
CVE-2024-26130 HIGH
7.5 Feb 21

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Rated high sever
CVE-2018-10903 HIGH
7.5 Jul 30

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. Rated high severity (CVSS 7.5), this vulnerab

Same weakness CWE-345 – Insufficient Verification of Data Authenticity

View all
CVE-2023-38831 HIGH POC
7.8
CVE-2016-4553 HIGH
8.6
CVE-2016-4554 HIGH
8.6
CVE-2014-4936 CRITICAL POC
9.3
CVE-2025-66255 CRITICAL POC
9.9
CVE-2026-62874 CRITICAL POC
9.8
CVE-2025-1945 CRITICAL POC
9.8
CVE-2026-92161 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Image SL-Micro Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
SUSE Linux Micro 6.0 Fixed
SUSE Linux Micro 6.1 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed

References

Advisories & patches
PATCH https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c ADVISORY https://access.redhat.com/errata/RHSA-2026:2694 ADVISORY https://access.redhat.com/errata/RHSA-2026:5168 ADVISORY https://access.redhat.com/errata/RHSA-2026:5665 ADVISORY https://access.redhat.com/errata/RHSA-2026:6308 ADVISORY https://access.redhat.com/errata/RHSA-2026:6309 ADVISORY https://access.redhat.com/errata/RHSA-2026:6404 ADVISORY https://access.redhat.com/errata/RHSA-2026:6497 ADVISORY https://access.redhat.com/errata/RHSA-2026:6567 ADVISORY https://access.redhat.com/errata/RHSA-2026:6568 ADVISORY https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2 ADVISORY https://vuldb.com/vuln/345372 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20655/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20706/ REF http://www.openwall.com/lists/oss-security/2026/02/10/4 REF https://access.redhat.com/errata/RHSA-2026:10184 REF https://access.redhat.com/errata/RHSA-2026:12176 REF https://access.redhat.com/errata/RHSA-2026:13512 REF https://access.redhat.com/errata/RHSA-2026:13545 REF https://access.redhat.com/errata/RHSA-2026:13553 REF https://access.redhat.com/errata/RHSA-2026:13672 REF https://access.redhat.com/errata/RHSA-2026:19355 REF https://access.redhat.com/errata/RHSA-2026:21431 REF https://access.redhat.com/errata/RHSA-2026:21517 REF https://access.redhat.com/errata/RHSA-2026:22330 REF https://access.redhat.com/errata/RHSA-2026:22993 REF https://access.redhat.com/errata/RHSA-2026:7295 REF https://access.redhat.com/security/cve/CVE-2026-26007 REF https://bugzilla.redhat.com/show_bug.cgi?id=2438762 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26007.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy