CVE-2026-39892
CriticalAdvisory
Published 8 Apr 2026In the index since 5 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.8
- base score, highest
- EPSS
- 0.007
- 49th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 171
- of 17,781 indexed, latest versions
- Container images
- 68
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
The matching OSV records carry no description.
Carried by container images the latest versions of 171 of 17,781 indexed charts deploy, on 68 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| cryptographypypi | 45.0.2, 45.0.3, 45.0.4, 45.0.5+9 more | 46.0.7 | 68 |
| py3-cryptographyapk | 46.0.5-r0 | 46.0.7-r0 | 1 |
- OSV records
- ALPINE-CVE-2026-39892PYSEC-2026-36
- Also known as
- GHSA-p423-j2cm-9vmq
Charts affected
171 by stars
Container images carrying it
68 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | 7dcddc01f13b | cryptography | 46.0.7 | 89 |
| library/ | b3b90af2a655 | cryptography | 46.0.7 | 16 |
| library/ | 257388edf9c8 | cryptography | 46.0.7 | 6 |
| apache/ | 16b50bbef664 | cryptography | 46.0.7 | 3 |
| library/ | b2cf29815e62 | cryptography | 46.0.7 | 2 |
| taigaio/ | 4beed8f62c9f | cryptography | 46.0.7 | 2 |
| apache/ | 80072bb73dd3 | cryptography | 46.0.7 | 1 |
| appwrite/ | 1aaa70127114 | cryptography py3-cryptography | 46.0.7 46.0.7-r0 | 1 |
| boky/ | aafc77238423 | cryptography | 46.0.7 | 1 |
| chiefonboarding/ | 59bc7aa60fe7 | cryptography | 46.0.7 | 1 |
| datamate/ | 2dd66b722464 | cryptography | 46.0.7 | 1 |
| dpage/ | 50700ac17936 | cryptography | 46.0.7 | 1 |
| freedom98/ | d7ce1533f297 | cryptography | 46.0.7 | 1 |
| heartexlabs/ | aa461572e8f9 | cryptography | 46.0.7 | 1 |
| helmforge/ | 61f759a1421f | cryptography | 46.0.7 | 1 |
| knspar/ | 09499d2dc91a | cryptography | 46.0.7 | 1 |
| kyovint/ | 48c19e3ae9a3 | cryptography | 46.0.7 | 1 |
| kyovint/ | 80084149156e | cryptography | 46.0.7 | 1 |
| library/ | 3466ba4a4828 | cryptography | 46.0.7 | 1 |
| library/ | 85b9bf2e29cf | cryptography | 46.0.7 | 1 |
| library/ | 8dbcf531a03a | cryptography | 46.0.7 | 1 |
| linuxserver/ | 052eac68ccc0 | cryptography | 46.0.7 | 1 |
| litellm/ | 09b217802ded | cryptography | 46.0.7 | 1 |
| mawad98/ | 99422c56a274 | cryptography | 46.0.7 | 1 |
| opencsghq/ | af7191a9cf8a | cryptography | 46.0.7 | 1 |
| opencsghq/ | c36a5bac3cf0 | cryptography | 46.0.7 | 1 |
| opendatacube/ | 80df355a660b | cryptography | 46.0.7 | 1 |
| openvpn/ | 2253c10ec652 | cryptography | 46.0.7 | 1 |
| prompve/ | e3d501a82df5 | cryptography | 46.0.7 | 1 |
| redash/ | 00d813437db5 | cryptography | 46.0.7 | 1 |
| redash/ | c5c9148f5c38 | cryptography | 46.0.7 | 1 |
| rommapp/ | b909e95d1aab | cryptography | 46.0.7 | 1 |
| tinymediamanager/ | 2b34dc85099e | cryptography | 46.0.7 | 1 |
| tock/ | abf7880e0449 | cryptography | 46.0.7 | 1 |
| tussanakorndev/ | 216fdadadf9a | cryptography | 46.0.7 | 1 |
| vabene1111/ | 0f8d061895e9 | cryptography | 46.0.7 | 1 |
| zepai/ | 6ab0ee79926b | cryptography | 46.0.7 | 1 |
| ghcr.io/ | 870e396fddf8 | cryptography | 46.0.7 | 1 |
| ghcr.io/ | afa5a729114e | cryptography | 46.0.7 | 1 |
| ghcr.io/ | 3225d2bc6b3c | cryptography | 46.0.7 | 1 |
| ghcr.io/ | e59ebde55709 | cryptography | 46.0.7 | 1 |
| ghcr.io/ | 46a71d75dfd3 | cryptography | 46.0.7 | 1 |
| ghcr.io/ | 06a16d4f279f | cryptography | 46.0.7 | 1 |
| ghcr.io/ | 9a5a3eb4a213 | cryptography | 46.0.7 | 1 |
| ghcr.io/ | 067e54e2e107 | cryptography | 46.0.7 | 1 |
| ghcr.io/ | cd25a5cc3f1b | cryptography | 46.0.7 | 1 |
| ghcr.io/ | 3009350bfc11 | cryptography | 46.0.7 | 1 |
| ghcr.io/ | bb2939094eed | cryptography | 46.0.7 | 1 |
| ghcr.io/ | 3522e8a7a8f0 | cryptography | 46.0.7 | 1 |
| ghcr.io/ | eef3ee7810d0 | cryptography | 46.0.7 | 1 |