CVE-2024-26130

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.

• CWE-476
• CWE-476

• https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55Patch
• https://github.com/pyca/cryptography/pull/10423Issue Tracking, Patch
• https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4Vendor Advisory
• https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55Patch
• https://github.com/pyca/cryptography/pull/10423Issue Tracking, Patch
• https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4Vendor Advisory

Published

Feb 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26125Adobe Experience Manager versions 6.5.19 and earlier are aff…5.4
• CVE-2024-26126Adobe Experience Manager versions 6.5.20 and earlier are aff…3.5
• CVE-2024-26127Adobe Experience Manager versions 6.5.20 and earlier are aff…3.5
• CVE-2024-26128baserCMS is a website development framework. Prior to versio…5.4
• CVE-2024-26129PrestaShop is an open-source e-commerce platform. Starting i…5.3
• CVE-2024-2613Data was not properly sanitized when decoding a QUIC ACK fra…7.5
• CVE-2024-26131Element Android is an Android Matrix Client. Element Android…7.8
• CVE-2024-26132Element Android is an Android Matrix Client. A third-party m…3.3
• CVE-2024-26133EventStoreDB (ESDB) is an operational database built to stor…4.9
• CVE-2024-26134cbor2 provides encoding and decoding for the Concise Binary …7.5
• CVE-2024-26135MeshCentral is a full computer management web site. Versions…8.8
• CVE-2024-26136kedi ElectronCord is a bot management tool for Discord. Comm…7.5