cryptography — CVE history (PyPI)
cryptography
11 CVEs affect the cryptography PyPI package (highest CVSS 9.8). Latest disclosed: 2026-04-08. Full CVE history sourced from NVD.
Summary
- Package
cryptography(PyPI)- Total CVEs
11- Actively exploited (CISA KEV)
- 0
- Highest CVSS
9.8- Latest disclosed
- 2026-04-08
Recent CVEs (top 11)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-39892 | Critical | 9.8 | — | 2026-04-08 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. |
CVE-2026-34073 | Medium | 5.3 | — | 2026-03-31 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. |
CVE-2026-26007 | Medium | 6.5 | — | 2026-02-10 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. |
CVE-2024-26130 | High | 7.5 | — | 2024-02-21 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. |
CVE-2023-50782 | High | 7.5 | — | 2024-02-05 | A flaw was found in the python-cryptography package. |
CVE-2023-49083 | Medium | 5.9 | — | 2023-11-29 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. |
CVE-2023-38325 | High | 7.5 | — | 2023-07-14 | The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. |
CVE-2023-23931 | Medium | 4.8 | — | 2023-02-07 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. |
CVE-2020-36242 | Critical | 9.1 | — | 2021-02-07 | In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class. |
CVE-2020-25659 | Medium | 5.9 | — | 2021-01-11 | python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext. |
CVE-2016-9243 | High | 7.5 | — | 2017-03-27 | HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size. |
All-time worst (top 10 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-39892 | Critical | 9.8 | — | 2026-04-08 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. |
CVE-2020-36242 | Critical | 9.1 | — | 2021-02-07 | In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class. |
CVE-2024-26130 | High | 7.5 | — | 2024-02-21 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. |
CVE-2023-50782 | High | 7.5 | — | 2024-02-05 | A flaw was found in the python-cryptography package. |
CVE-2023-38325 | High | 7.5 | — | 2023-07-14 | The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. |
CVE-2016-9243 | High | 7.5 | — | 2017-03-27 | HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size. |
CVE-2026-26007 | Medium | 6.5 | — | 2026-02-10 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. |
CVE-2023-49083 | Medium | 5.9 | — | 2023-11-29 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. |
CVE-2020-25659 | Medium | 5.9 | — | 2021-01-11 | python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext. |
CVE-2026-34073 | Medium | 5.3 | — | 2026-03-31 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. |