# What changed in cryptography

> 7 changes in cryptography 46 to 50 from its official release notes, upgrade guides and advisories: 7 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/pypi/cryptography/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## cryptography 50

### Security

- cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing (50.0.0) — [security advisory](https://github.com/advisories/GHSA-G6CJ-PR64-35W5)

## cryptography 49

### Security

- python-cryptography: Duplicate self-signed intermediates can cause exponential path-building (49.0.0) — [security advisory](https://github.com/advisories/GHSA-JWV3-5HGF-82WW)
- python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees (49.0.0) — [security advisory](https://github.com/advisories/GHSA-M2H6-J472-RP4C)

## cryptography 48

### Security

- Vulnerable OpenSSL included in cryptography wheels (48.0.1) — [security advisory](https://github.com/advisories/GHSA-537C-GMF6-5CCF)

## cryptography 46

### Security

- Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs (46.0.7) — [security advisory](https://github.com/advisories/GHSA-P423-J2CM-9VMQ)
- cryptography has incomplete DNS name constraint enforcement on peer names (46.0.6) — [security advisory](https://github.com/advisories/GHSA-M959-CC7F-WV43)
- cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (46.0.5) — [security advisory](https://github.com/advisories/GHSA-R6PH-V2QM-Q3C2)