Vulnerability · Published Feb 10, 2026 · Assigned by GitHub_M
CVE-2026-26007cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
High 7.4
In plain English
A high-severity insufficient verification of data authenticity in cryptography from pyca. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.4%top 67.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | fence-agents-aliyun | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-all | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-amt-ws | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-apc | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-apc-snmp | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-aws | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-azure-arm | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-bladecenter | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-brocade | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-cisco-mds | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-cisco-ucs | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-common | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-compute | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-drac5 | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-eaton-snmp | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-emerson | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-eps | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-gce | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-heuristics-ping | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-hpblade | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-ibm-powervs | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-ibm-vpc | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-ibmblade | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-ifmib | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-ilo-moonshot | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-ilo-mp | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-ilo-ssh | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-ilo2 | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-intelmodular | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-ipdu | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-ipmilan | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-kdump | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-kubevirt | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-lpar | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-mpath | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-nutanix-ahv | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-openstack | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-redfish | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-rhevm | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-rsa | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-rsb | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-sbd | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-scsi | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-virsh | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-vmware-rest | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-vmware-soap | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-wti | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-zvm | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| Alpine:v3.23 | py3-cryptography | 46.0.5-r0 | ALPINE-CVE-2026-26007 |
| Alpine:v3.24 | py3-cryptography | 46.0.5-r0 | ALPINE-CVE-2026-26007 |
| Debian:12 | python-cryptography | no fix listed | DEBIAN-CVE-2026-26007 |
| Debian:13 | python-cryptography | 43.0.0-3+deb13u1 | DEBIAN-CVE-2026-26007 |
| Debian:14 | python-cryptography | 46.0.5-1 | DEBIAN-CVE-2026-26007 |
| PyPI | cryptography | 46.0.5 | PYSEC-2026-2141 |
| PyPI | cryptography | 46.0.5 | GHSA-r6ph-v2qm-q3c2 |
| Rocky Linux:8 | fence-agents | 0:4.2.1-129.el8_10.25 | RLSA-2026:12176 |
| Rocky Linux:9 | fence-agents | 0:4.10.0-110.el9_8.2 | RLSA-2026:19355 |
| Rocky Linux:9 | fence-agents | 0:4.10.0-98.el9_7.12 | RLSA-2026:13672 |
| Ubuntu:22.04:LTS | python-cryptography | 3.4.8-1ubuntu2.3 | USN-8087-1 |
| Ubuntu:22.04:LTS | python-cryptography | 3.4.8-1ubuntu2.3 | UBUNTU-CVE-2026-26007 |
| Ubuntu:24.04:LTS | python-cryptography | 41.0.7-4ubuntu0.3 | UBUNTU-CVE-2026-26007 |
| Ubuntu:24.04:LTS | python-cryptography | 41.0.7-4ubuntu0.3 | USN-8087-1 |
| Ubuntu:25.10 | python-cryptography | 43.0.0-1ubuntu1.1 | UBUNTU-CVE-2026-26007 |
| Ubuntu:25.10 | python-cryptography | 43.0.0-1ubuntu1.1 | USN-8087-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pyca | cryptography | < 46.0.5 |
Weakness: CWE-345, CWE-354 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2 x_refsource_CONFIRM
- https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c x_refsource_MISC
- http://www.openwall.com/lists/oss-security/2026/02/10/4
- https://access.redhat.com/security/cve/CVE-2026-26007 vdb-entry, x_refsource_REDHAT
- RHBZ#2438762 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26007.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:13512 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:12176 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22330 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21517 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21431 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13672 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19355 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6308 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13553 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13545 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6309 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2694 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7295 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10184 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5665 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6568 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6497 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6567 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5168 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22993 vendor-advisory, x_refsource_REDHAT