Status: UPDATED | Advisory ID: CVE-2026-39892
| CVE | CVE-2026-39892 |
| CVSS Score / Version | |
| Updated | 2026-11-04 |
| CVSS Vector | |
| CVSS Prose | |
| Affected products | |
| Classified as |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Red Hat | Red Hat AI Inference Server 3.3 | ||
| Red Hat | Red Hat Ansible Automation Platform 2.6 | ||
| Red Hat | Red Hat OpenShift AI 3.3 | ||
| Red Hat | Red Hat AI Inference Server | ||
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | ||
| Red Hat | Red Hat OpenShift AI (RHOAI) | ||
| Red Hat | Red Hat OpenShift AI 2.25 | ||
| Red Hat | Red Hat Enterprise Linux 8 | ||
| Red Hat | Red Hat Enterprise Linux 9 | ||
| Red Hat | Red Hat Hardened Images | ||
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | ||
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | ||
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | ||
| Red Hat | Red Hat Quay 3.10 | ||
| Red Hat | Red Hat Quay 3.12 | ||
| Red Hat | Red Hat Quay 3.14 | ||
| Red Hat | Red Hat Quay 3.15 | ||
| Red Hat | Red Hat Quay 3.16 | ||
| Red Hat | Red Hat Quay 3.17 | ||
| Red Hat | Red Hat Quay 3.9 | ||
| Red Hat | Red Hat Ansible Automation Platform 2 | ||
| Red Hat | Red Hat Satellite 6 | ||
| Red Hat | Red Hat Discovery 2 | ||
| Red Hat | Red Hat Enterprise Linux AI 3.3 | ||
| Red Hat | Migration Toolkit for Applications 8 | ||
| Red Hat | Red Hat Ansible Automation Platform Ansible Core 2 | ||
| Red Hat | Red Hat Quay 3 | ||
| Red Hat | Red Hat Trusted Artifact Signer 1.4 | ||
| Red Hat | Lightspeed Core | ||
| cryptography.io | cryptography |
| Subsystems | OT Supporting Infrastructure |
| Sectors | Multiple |
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7. (NVD)
Monitor Red Hat's and cryptography.io's web pages for any future patch releases. See vendor advisory link below.