PyPI/cryptography CVE-2026-69247: high 8.2, EPSS 0.27%

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Action: Upgrade cryptography to 50.0.0 or later.

pip install cryptography==50.0.0

Affected

Fixed versions

Sources

• osv: GHSA-g6cj-pr64-35w5
• nvd: CVE-2026-69247
• https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5
• https://github.com/pyca/cryptography/pull/15369
• https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f
• https://github.com/pyca/cryptography

CVE-2026-69247 · published 2026-08-03T21:17:00Z · modified 2026-09-10T03:50:53.610446769Z · JSON