CVE-2026-26007
📋 TL;DR
This vulnerability in the Python cryptography package allows attackers to provide specially crafted public keys from small-order subgroups, bypassing validation. When exploited, it can leak private key information during ECDH key exchange or enable signature forgery in ECDSA. Only users of affected cryptography versions implementing ECDH or ECDSA with SECT curves are impacted.
💻 Affected Systems
- Python cryptography package
📦 What is this software?
Cryptography by Cryptography.io
⚠️ Risk & Real-World Impact
Worst Case
Complete private key compromise through repeated ECDH operations, enabling impersonation, data decryption, and signature forgery.
Likely Case
Partial private key leakage (least significant bits) during ECDH key exchange, weakening cryptographic security.
If Mitigated
No impact if systems are patched or don't use affected SECT curves for ECDH/ECDSA operations.
🎯 Exploit Status
Exploitation requires the attacker to provide a malicious public key, which could be done through various protocols using ECDH/ECDSA.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 46.0.5
Vendor Advisory: https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2
Restart Required: No
Instructions:
1. Update cryptography package: pip install --upgrade cryptography==46.0.5
2. Verify installation: pip show cryptography
3. Restart any Python applications using cryptography.
🔧 Temporary Workarounds
Avoid SECT curves
allTemporarily switch to non-SECT curves (like NIST P-256, P-384, P-521) for ECDH/ECDSA operations
🧯 If You Can't Patch
- Implement additional validation of public keys before use in cryptographic operations
- Monitor for unusual cryptographic operations or failed key validations
🔍 How to Verify
Check if Vulnerable:
Check cryptography version: python -c "import cryptography; print(cryptography.__version__)"Check Version:
python -c "import cryptography; print(cryptography.__version__)"Verify Fix Applied:
Verify version is 46.0.5 or higher: python -c "import cryptography; print(cryptography.__version__ >= '46.0.5')"📡 Detection & Monitoring
Log Indicators:
- Failed cryptographic operations
- Unusual key validation errors
- Multiple failed ECDH handshakes
Network Indicators:
- Repeated failed TLS/SSL handshakes using ECDHE
- Unusual public key sizes or formats
SIEM Query:
Search for cryptography package version <46.0.5 in system inventory logs