cryptography (PyPI)
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
Advisories
55
Latest version
50.0.2
Released Sep 30, 2026
License
Apache-2.0 OR BSD-3-Clause
OpenSSF Scorecard
8.3 / 10
How to fix
Upgrading to 50.0.0 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "cryptography>=50.0.2"poetry
poetry add "cryptography>=50.0.2"uv
uv add "cryptography>=50.0.2"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-m2h6-j472-rp4c python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees |
Medium EPSS 0.24% |
< 49.0.0 | 49.0.0 |
| GHSA-m2h6-j472-rp4c python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees |
Medium EPSS 0.24% |
>= 45.0.0, < 49.0.0 | 49.0.0 |
| GHSA-m2h6-j472-rp4c python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees |
Medium EPSS 0.24% |
>= 45.0.0, < 49.0.0 | 49.0.0 |
| GHSA-jwv3-5hgf-82ww python-cryptography: Duplicate self-signed intermediates can cause exponential path-building |
High EPSS 0.26% |
< 49.0.0 | 49.0.0 |
| GHSA-jwv3-5hgf-82ww python-cryptography: Duplicate self-signed intermediates can cause exponential path-building |
High EPSS 0.26% |
>= 42.0.0, < 49.0.0 | 49.0.0 |
| GHSA-jwv3-5hgf-82ww python-cryptography: Duplicate self-signed intermediates can cause exponential path-building |
High EPSS 0.26% |
>= 42.0.0, < 49.0.0 | 49.0.0 |
| GHSA-g6cj-pr64-35w5 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing |
High EPSS 0.27% |
>= 44.0.0, < 50.0.0 | 50.0.0 |
| GHSA-g6cj-pr64-35w5 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing |
High EPSS 0.27% |
>= 44.0.0, < 50.0.0 | 50.0.0 |
| GHSA-g6cj-pr64-35w5 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing |
High EPSS 0.27% |
>= 44.0.0, < 50.0.0 | 50.0.0 |
| GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheels |
High | >= 0.5.0, < 48.0.1 | 48.0.1 |
| GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheels |
High | >= 0.5.0, < 48.0.1 | 48.0.1 |
| GHSA-p423-j2cm-9vmq Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs |
Medium EPSS 0.65% |
>= 45.0.0, < 46.0.7 | 46.0.7 |
| GHSA-p423-j2cm-9vmq Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs |
Medium EPSS 0.65% |
>= 45.0.0, < 46.0.7 | 46.0.7 |
| GHSA-p423-j2cm-9vmq Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs |
Medium EPSS 0.65% |
>= 45.0.0, < 46.0.7 | 46.0.7 |
| GHSA-m959-cc7f-wv43 cryptography has incomplete DNS name constraint enforcement on peer names |
Low EPSS 0.23% |
< 46.0.6 | 46.0.6 |
| GHSA-m959-cc7f-wv43 cryptography has incomplete DNS name constraint enforcement on peer names |
Low EPSS 0.23% |
< 46.0.6 | 46.0.6 |
| GHSA-m959-cc7f-wv43 cryptography has incomplete DNS name constraint enforcement on peer names |
Low EPSS 0.23% |
< 46.0.6 | 46.0.6 |
| GHSA-r6ph-v2qm-q3c2 cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves |
High EPSS 0.39% |
< 46.0.5 | 46.0.5 |
| GHSA-r6ph-v2qm-q3c2 cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves |
High EPSS 0.39% |
< 46.0.5 | 46.0.5 |
| GHSA-r6ph-v2qm-q3c2 cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves |
High EPSS 0.39% |
<= 46.0.4 | No fix yet |
| GHSA-79v4-65xg-pq4g Vulnerable OpenSSL included in cryptography wheels |
Medium EPSS 2.53% |
>= 42.0.0, < 44.0.1 | 44.0.1 |
| GHSA-79v4-65xg-pq4g Vulnerable OpenSSL included in cryptography wheels |
Medium EPSS 2.53% |
>= 42.0.0, < 44.0.1 | 44.0.1 |
| GHSA-h4gh-qq45-vh27 pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels |
Medium | >= 37.0.0, < 43.0.1 | 43.0.1 |
| GHSA-6vqw-3v5j-54x4 cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override |
High EPSS 0.83% |
>= 38.0.0, < 42.0.4 | 42.0.4 |
| GHSA-6vqw-3v5j-54x4 cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override |
High EPSS 0.83% |
>= 38.0.0, < 42.0.4 | 42.0.4 |
| GHSA-6vqw-3v5j-54x4 cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override |
High EPSS 0.83% |
>= 38.0.0, < 42.0.4 | 42.0.4 |
| GHSA-3ww4-gg4f-jr7f Python Cryptography package vulnerable to Bleichenbacher timing oracle attack |
High EPSS 1.12% |
< 42.0.0 | 42.0.0 |
| GHSA-3ww4-gg4f-jr7f Python Cryptography package vulnerable to Bleichenbacher timing oracle attack |
High EPSS 1.12% |
< 42.0.0 | 42.0.0 |
| GHSA-3ww4-gg4f-jr7f Python Cryptography package vulnerable to Bleichenbacher timing oracle attack |
High EPSS 1.12% |
< 42.0.0 | 42.0.0 |
| GHSA-9v9h-cgj8-h64p Null pointer dereference in PKCS12 parsing |
Medium EPSS 3.19% |
< 42.0.2 | 42.0.2 |
| GHSA-9v9h-cgj8-h64p Null pointer dereference in PKCS12 parsing |
Medium EPSS 3.19% |
< 42.0.2 | 42.0.2 |
| GHSA-9v9h-cgj8-h64p Null pointer dereference in PKCS12 parsing |
Medium EPSS 3.19% |
< 42.0.2 | 42.0.2 |
| GHSA-jfhm-5ghh-2f97 cryptography vulnerable to NULL-dereference when loading PKCS7 certificates |
High EPSS 0.98% |
>= 3.1, < 41.0.6 | 41.0.6 |
| GHSA-jfhm-5ghh-2f97 cryptography vulnerable to NULL-dereference when loading PKCS7 certificates |
High EPSS 0.98% |
>= 3.1, < 41.0.6 | 41.0.6 |
| GHSA-jfhm-5ghh-2f97 cryptography vulnerable to NULL-dereference when loading PKCS7 certificates |
High EPSS 0.98% |
>= 3.1, < 41.0.6 | 41.0.6 |
| GHSA-v8gr-m533-ghj9 Vulnerable OpenSSL included in cryptography wheels |
Low | >= 2.5, < 41.0.4 | 41.0.4 |
| GHSA-jm77-qphf-c4w8 pyca/cryptography's wheels include vulnerable OpenSSL |
Low | >= 0.8, < 41.0.3 | 41.0.3 |
| GHSA-cf7p-gm2m-833m cryptography mishandles SSH certificates |
High EPSS 0.73% |
>= 40.0.0, < 41.0.2 | 41.0.2 |
| GHSA-cf7p-gm2m-833m cryptography mishandles SSH certificates |
High EPSS 0.73% |
>= 40.0.0, < 41.0.2 | 41.0.2 |
| GHSA-5cpq-8wj7-hf2v Vulnerable OpenSSL included in cryptography wheels |
Low | >= 0.5, < 41.0.0 | 41.0.0 |
| GHSA-w7pp-m8wf-vj6r Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf |
Medium EPSS 1.30% |
>= 1.8, < 39.0.1 | 39.0.1 |
| GHSA-w7pp-m8wf-vj6r Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf |
Medium EPSS 1.30% |
>= 1.8, < 39.0.1 | 39.0.1 |
| GHSA-w7pp-m8wf-vj6r Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf |
Medium EPSS 1.30% |
>= 1.8, < 39.0.1 | 39.0.1 |
| GHSA-x4qr-2fvf-3mr5 Vulnerable OpenSSL included in cryptography wheels |
High EPSS 69.29% |
>= 0.8.1, < 39.0.1 | 39.0.1 |
| GHSA-x4qr-2fvf-3mr5 Vulnerable OpenSSL included in cryptography wheels |
High EPSS 69.29% |
>= 0.8.1, < 39.0.1 | 39.0.1 |
| GHSA-x4qr-2fvf-3mr5 Vulnerable OpenSSL included in cryptography wheels |
High EPSS 69.29% |
>= 0.8.1, < 39.0.1 | 39.0.1 |
| GHSA-39hc-v87j-747x Vulnerable OpenSSL included in cryptography wheels |
Medium | >= 37.0.0, < 38.0.3 | 38.0.3 |
| GHSA-rhm9-p9w5-fwm7 PyCA Cryptography symmetrically encrypting large values can lead to integer overflow |
Critical EPSS 6.72% |
>= 3.1, < 3.3.2 | 3.3.2 |
| GHSA-rhm9-p9w5-fwm7 PyCA Cryptography symmetrically encrypting large values can lead to integer overflow |
Critical EPSS 6.72% |
>= 3.1, < 3.3.2 | 3.3.2 |
| GHSA-hggm-jpg3-v476 RSA decryption vulnerable to Bleichenbacher timing vulnerability |
Medium EPSS 2.46% |
< 3.2.1 | 3.2.1 |
| GHSA-hggm-jpg3-v476 RSA decryption vulnerable to Bleichenbacher timing vulnerability |
Medium EPSS 2.46% |
< 3.2 | 3.2 |
| GHSA-fcf9-3qw3-gxmj PyCA Cryptography vulnerable to GCM tag forgery |
High EPSS 3.20% |
>= 1.9, < 2.3 | 2.3 |
| GHSA-fcf9-3qw3-gxmj PyCA Cryptography vulnerable to GCM tag forgery |
High EPSS 3.20% |
>= 1.9.0, < 2.3 | 2.3 |
| GHSA-q3cj-2r34-2cwc Improper input validation in cryptography |
High EPSS 3.46% |
< 1.5.3 | 1.5.3 |
| GHSA-q3cj-2r34-2cwc Improper input validation in cryptography |
High EPSS 3.46% |
< 1.5.3 | 1.5.3 |
Source: https://github.com/pyca/cryptography
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor