CVE-2026-69247

A flaw was found in cryptography, a Python package for cryptographic primitives. This vulnerability, known as a Bleichenbacher oracle, arises during PKCS#7 EnvelopedData decryption. An attacker can exploit distinguishable error messages and timing differences during decryption to gain information about the content-encryption key. Exploitation requires a high-volume service, such as an S/MIME gateway, that automatically decrypts untrusted data matching a victim's certificate. Successful exploitation could lead to the disclosure of sensitive encryption keys, allowing an attacker to decrypt confidential communications.

Red Hat rates this Moderate (CVSS 3.1 5.9). Exploitation requires an application that decrypts attacker-supplied PKCS#7 EnvelopedData via pkcs7_decrypt_* and leaks errors or timing. GitHub CNA CVSS 4.0 8.2 assumes that oracle is readily available.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable APIs were introduced in cryptography 44.0.0 and fixed in 50.0.0.