CVE-2026-39892

ADVISORY - github

Summary

If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. For example:

h = Hash(SHA256())
b.update(buf[::-1])

would read past the end of the buffer on Python >3.11

EPSS Score⁠: 0.00021 (0.061)

ADVISORY - nist

Improper Restriction of Operations within the Bounds of a Memory Buffer

ADVISORY - github

Improper Restriction of Operations within the Bounds of a Memory Buffer

ADVISORY - redhat

Incorrect Calculation of Buffer Size

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.