CVE-2023-49083

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.

• CWE-476

• https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48aPatch
• https://github.com/pyca/cryptography/pull/9926Issue Tracking, Patch
• https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97Exploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/
• https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48aPatch
• https://github.com/pyca/cryptography/pull/9926Issue Tracking, Patch
• https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97Exploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/10/msg00012.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMNTYMUGFJSDBYBU22FUYBHFRZODRKXV/

Published

Nov 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49078raptor-web is a CMS for game server communities that can be …6.1
• CVE-2023-49079Misskey is an open source, decentralized social media platfo…7.5
• CVE-2023-4908Inappropriate implementation in Picture in Picture in Google…4.3
• CVE-2023-49080The Jupyter Server provides the backend (i.e. the core servi…4.3
• CVE-2023-49081aiohttp is an asynchronous HTTP client/server framework for …5.3
• CVE-2023-49082aiohttp is an asynchronous HTTP client/server framework for …5.3
• CVE-2023-49084Cacti is a robust performance and fault management framework…8.8
• CVE-2023-49085Cacti provides an operational monitoring and fault managemen…8.8
• CVE-2023-49086Cacti is a robust performance and fault management framework…5.4
• CVE-2023-49087xml-security is a library that implements XML signatures and…7.5
• CVE-2023-49088Cacti is an open source operational monitoring and fault man…4.8
• CVE-2023-49089Umbraco is an ASP.NET content management system (CMS). Start…6.5