Loading story…
A high-severity flaw tracked as CVE-2026-69247 was disclosed in the Python cryptography package, where PKCS#7 EnvelopedData decryption can leak distinguishable errors and timing differences during RSA PKCS#1 v1.5 processing. The bug affects versions 44.0.0 through 49.x and enables a classic Bleichenbacher-style oracle against RecipientInfo encryptedKey handling, potentially allowing an unauthenticated remote attacker to recover content-encryption keys and decrypt sensitive PKCS#7-protected data such as S/MIME messages.
The exposure is most relevant to services that decrypt attacker-supplied PKCS#7 content at scale, including S/MIME gateways, secure mail filters, and document-processing systems. Reports say the issue stems from non-uniform error handling, early aborts, and observable timing discrepancies across invalid padding, wrong key sizes, malformed keys, and successful decryptions; cryptography 50.0.0 fixes the problem by using RFC 3218-style random key substitution so failed RSA decryptions continue through symmetric decryption and reduce oracle leakage. No active exploitation has been reported, and the vulnerability is not listed in CISA's KEV catalog.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On August 3, 2026, CVE-2026-69247 was publicly described as a high-severity Bleichenbacher oracle in pyca/cryptography PKCS#7 decryption affecting versions before 50.0.0. The disclosure notes remote exploitability in services such as S/MIME gateways and mail filters that decrypt attacker-supplied EnvelopedData and expose adaptive responses.
On July 31, 2026, pyca/cryptography committed a fix for PKCS#7 RSA PKCS#1 v1.5 encryptedKey handling so decryption failures no longer expose distinguishable errors or timing differences that could enable a Bleichenbacher oracle. The commit also added documentation warning that PKCS#7 EnvelopedData still permits CBC padding oracle risks if applications reveal decryption success.
The pyca/cryptography project fixed CVE-2026-69247 in version 50.0.0. The patch changes PKCS#7 decryption handling to continue with a random fallback key and reduce distinguishable error and timing behavior during RSA PKCS#1 v1.5 processing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**OpenSSL released a security update on January 27, 2026**, addressing **12 vulnerabilities** across supported branches, including **one High-severity issue with potential remote code execution (RCE)**, one Moderate, and multiple Low-severity flaws. The most serious vulnerability, **CVE-2025-15467 (High)**, is a **pre-authentication stack buffer overflow** in **CMS `AuthEnvelopedData` parsing** when using AEAD ciphers (e.g., **AES-GCM**); a crafted CMS message with an **oversized IV in ASN.1 parameters** can trigger a crash and may enable code execution in applications that parse **untrusted CMS/PKCS#7 content** (notably **S/MIME** workflows). Both sources emphasize that while **DoS is the most likely outcome in many environments**, the presence of a stack write primitive makes the issue operationally significant where untrusted CMS is processed. A second notable issue, **CVE-2025-11187 (Moderate)**, involves a **stack overflow during PKCS#12 MAC verification** (PBMAC1/PBKDF2-related validation), where attacker-controlled parameters (e.g., key length) can lead to crashes and potentially more severe impact when processing **untrusted PKCS#12 files** (e.g., certificate import/export, PKI/CA tooling). Affected versions called out include **OpenSSL 3.x** (with additional low-severity issues spanning older branches such as **1.0.2 and 1.1.1**), and patched releases include **3.6.1, 3.5.5, 3.4.4, 3.3.6, and 3.0.19** (with corresponding fixes for older maintained lines). Datadog notes **OpenSSL 3.x FIPS modules are not affected** by the highlighted CMS and PKCS#12 overflow issues, and both sources point to higher risk in services that ingest these formats from external or user-supplied inputs (e.g., S/MIME gateways, certificate management services).
Jun 29, 2026
OpenSSL disclosed a broad set of vulnerabilities affecting ASN.1 parsing, PKCS#12, CMS/PKCS#7, QUIC, OCSP, CMP/CRMF, DH key validation, AEAD cipher handling, and certificate and email validation across the 4.0, 3.6, 3.5, 3.4, and 3.0 branches. The most severe issue, **CVE-2026-45447**, is a high-severity heap use-after-free in `PKCS7_verify()` that can be triggered by specially crafted PKCS#7 or S/MIME signed messages and could lead to crashes, heap corruption, or potentially remote code execution. The advisory also details moderate-severity flaws that could enable forged CMS `AuthEnvelopedData` messages, denial-of-service conditions in QUIC and OCSP processing, a TLS client double-free via OCSP stapling, a QUIC server `NULL` dereference, and cryptographic failures in AES-OCB when applications use the `EVP_Cipher()` one-shot API, alongside numerous lower-severity parsing, validation, and bounds-checking bugs. OpenSSL said most issues were fixed in **4.0.1**, **3.6.3**, **3.5.7**, **3.4.6**, and **3.0.21**, with **1.1.1zh** and **1.0.2zq** issued for supported legacy customers; most flaws were reported as outside the OpenSSL FIPS module boundary, except **CVE-2026-42770**, which affects FIPS modules in multiple supported branches.
Jun 29, 2026
OpenSSL disclosed **CVE-2018-0737**, a low-severity cache-timing side channel in RSA private-key generation affecting versions before `1.0.2p` and `1.1.0i`. Three non-constant-time execution paths, including `BN_gcd`, could leak sensitive state to an attacker able to run a precisely timed cache attack on the same physical system while a key is generated, potentially allowing recovery of the newly generated RSA private key. Researchers demonstrated recovery through the `BN_gcd` path at an approximately 30% success rate across more than 10,000 cluster trials. OpenSSL incorporated fixes into `1.0.2p` and `1.1.0i`, with patches also available through upstream commits `349a41da1` and `6939eab03`. Exploitation requires stringent local or adjacent-system access and observation at the moment of key generation, limiting practical exposure; keys generated and retained in hardware security modules are not affected. Red Hat issued fixes for affected RHEL 7 and later systems and JBoss Core Services products.
Aug 29, 2026