CVE-2020-36242: Cryptography.io Cryptography

Critical severity, CVSS 9.1. EPSS: 6.7% chance of exploitation in the next 30 days.

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

Affected products

• Cryptography.io Cryptography: before 3.3.2 (fixed in 3.3.2)
• Fedoraproject Fedora: version 33 only
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only

Published 2021-02-07. Last modified 2026-06-17.