CVE-2026-26007

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-26007
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26007.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-26007
Aliases
Downstream
Related
Published
2026-02-10T21:42:56.471Z
Modified
2026-02-12T08:49:13.032772Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the publickeyfromnumbers (or EllipticCurvePublicNumbers.publickey()), EllipticCurvePublicNumbers.publickey(), loadderpublickey() and loadpempublickey() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victimprivatekey]P via ECDH, this leaks information about victimprivatekey mod (smallsubgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.

Database specific 
{
    "cwe_ids": [
        "CWE-345"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26007.json"
}
References

Affected packages

Git / github.com/pyca/cryptography

Affected ranges

Type
GIT
Repo
https://github.com/pyca/cryptography
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
06e120e682cb200e3f7050c02f0bcdac90c4c6ad

Affected versions

0.*
0.1
0.2
0.3
0.4
0.5
0.5.1
0.6
0.7
0.8
0.9
1.*
1.0
1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
2.*
2.0
2.1
2.2
2.3
2.4
2.4.1
2.5
2.6
2.6.1
2.7
2.8
2.9
3.*
3.0
3.1
3.2
3.3
3.4
35.*
35.0.0
36.*
36.0.0
37.*
37.0.0
38.*
38.0.0
39.*
39.0.0
40.*
40.0.0
41.*
41.0.0
42.*
42.0.0
43.*
43.0.0
44.*
44.0.0
45.*
45.0.0
46.*
46.0.0
46.0.1
46.0.2
46.0.3
46.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26007.json"