PyPI/cryptography CVE-2026-26007: medium 6.5, EPSS 0.39%
cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
Action: Upgrade cryptography to 46.0.5 or later.
pip install cryptography==46.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 46.0.5 | - |
Fixed versions
| 46.0.5 |
Sources
- osv: GHSA-r6ph-v2qm-q3c2
- nvd: CVE-2026-26007
- https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2
- https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c
- https://github.com/pyca/cryptography
- https://github.com/pyca/cryptography/releases/tag/46.0.5
- http://www.openwall.com/lists/oss-security/2026/02/10/4
CVE-2026-26007 · published · modified · JSON