PyPI/ecdsa CVE-2026-33936: medium 5.3, EPSS 0.48%

python-ecdsa: Denial of Service via improper DER length validation in crafted private keys

Action: Upgrade ecdsa to 0.19.2 or later.

pip install ecdsa==0.19.2

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2467
• https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-9f5j-8jwj-x28g
• https://nvd.nist.gov/vuln/detail/CVE-2026-33936
• https://github.com/tlsfuzzer/python-ecdsa/commit/bd66899550d7185939bf27b75713a2ac9325a9d3
• https://github.com/tlsfuzzer/python-ecdsa
• https://github.com/tlsfuzzer/python-ecdsa/releases/tag/python-ecdsa-0.19.2
• https://pypi.org/project/ecdsa
• https://github.com/advisories/GHSA-9f5j-8jwj-x28g

CVE-2026-33936 · published 2026-07-13T14:36:45.132128Z · modified 2026-07-13T16:31:45.568903235Z · JSON