StackPrism

PyPI package

cryptography vulnerabilities by version

The latest release, 50.0.2 (Sep 30, 2026), has no known vulnerabilities. 7 of the 10 most recent releases have known vulnerabilities. OSV.dev lists 24 advisories for cryptography; the newest was published on Aug 3, 2026.

PyPI (opens in a new tab) describes it as “cryptography is a package which provides cryptographic recipes and primitives to Python developers.”

Latest release
50.0.2
Sep 30, 2026, no known vulnerabilities
Advisories on OSV.dev
24
Newest Aug 3, 2026
Licence
Apache-2.0 OR BSD-3-Clause
OpenSSF Scorecard
8.3/10
pyca/cryptography (opens in a new tab)

Recent releases

PyPI doesn’t publish downloads per version, so these are the newest releases, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilities
50.0.2latestSep 30, 2026No known vulnerabilities
50.0.1Aug 25, 2026No known vulnerabilities
50.0.0Jul 31, 2026No known vulnerabilities
49.0.0Jun 12, 20261 known vulnerability, worst rated critical
48.0.1Jun 9, 20263 known vulnerabilities, worst rated critical
48.0.0May 4, 20264 known vulnerabilities, worst rated critical
47.0.0Apr 24, 20264 known vulnerabilities, worst rated critical
46.0.7Apr 8, 20264 known vulnerabilities, worst rated critical
46.0.6Mar 25, 20265 known vulnerabilities, worst rated critical
46.0.5Feb 10, 20266 known vulnerabilities, worst rated critical

Release lines

The newest release of each minor line, from the registry. cryptography doesn’t publish support dates we can check.

LineNewest releaseReleased
50.050.0.2Sep 30, 2026
49.049.0.0Jun 12, 2026
48.048.0.1Jun 9, 2026
47.047.0.0Apr 24, 2026
46.046.0.7Apr 8, 2026
45.045.0.7Sep 1, 2025

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-69248 on OSV.dev (opens in a new tab)GHSA-m2h6-j472-rp4c

    python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

    Affects >= 45.0.0, < 49.0.0. Published Aug 3, 2026.

  2. CriticalCVE-2026-69249 on OSV.dev (opens in a new tab)GHSA-jwv3-5hgf-82ww

    python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

    Affects >= 42.0.0, < 49.0.0. Published Aug 3, 2026.

  3. CriticalCVE-2026-69247 on OSV.dev (opens in a new tab)GHSA-g6cj-pr64-35w5

    cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

    Affects >= 44.0.0, < 50.0.0. Published Aug 3, 2026.

  4. CriticalGHSA-537c-gmf6-5ccf on OSV.dev (opens in a new tab)

    Vulnerable OpenSSL included in cryptography wheels

    Affects >= 0.5.0, < 48.0.1. Published Jun 15, 2026.

  5. WarningCVE-2026-39892 on OSV.dev (opens in a new tab)GHSA-p423-j2cm-9vmq

    Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs

    Affects >= 45.0.0, < 46.0.7. Published Apr 8, 2026.

All 24 advisories are on OSV.dev (opens in a new tab).

Which cryptography do you have?

Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for cryptography, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from pypistats.org. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, PyPI and deps.dev.