CVE-2026-69247

Received Received - Intake

PKCS#1 v1.5 Bleichenbacher Oracle in cryptography

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An application that decrypts attacker-supplied EnvelopedData and reflects the outcome gives the attacker a Bleichenbacher oracle against the content-encryption key. Decryption ran as RSA PKCS#1 v1.5 decrypt of encryptedKey, build an AES cipher from the result, then AES-CBC decrypt and PKCS#7 unpad. Invalid RSA padding, a valid padding with a bad key length, a correct length with a wrong key, and the real key each failed or succeeded differently. Case 1 is reachable only where the linked library lacks implicit rejection: OpenSSL 3.0 and 3.1, LibreSSL, and BoringSSL. Exploitation requires a service that auto-decrypts untrusted EnvelopedData matching the victim certificate and answers adaptively at high volume, such as an S/MIME gateway or mail filter. This issue is fixed in 50.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-69247

Affected Vendors & Products

Vendor	Product	Version / Range
openssl	openssl	3.0
openssl	openssl	3.1
libressl	libressl	*
boringssl	boringssl	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-208	Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

This vulnerability affects the cryptography package in Python versions 44.0.0 to 50.0.0. It involves three functions (pkcs7_decrypt_der, pkcs7_decrypt_pem, pkcs7_decrypt_smime) that decrypt data in a way that leaks information through timing differences or exact length recovery during RSA operations. This creates a Bleichenbacher oracle attack vector against the content-encryption key.

Detection Guidance

Detection requires monitoring for adaptive decryption responses in services handling S/MIME or PKCS#7 data. Check for services auto-decrypting untrusted EnvelopedData and reflecting decryption outcomes. Examine logs for timing differences or length disclosures during RSA PKCS#1 v1.5 decryption attempts.

Impact Analysis

If you use an affected version of the cryptography package in a service that automatically decrypts untrusted encrypted data (like an S/MIME gateway or mail filter), an attacker could exploit this to decrypt sensitive information. Exploitation requires high-volume adaptive responses from the service.

Compliance Impact

This vulnerability could lead to unauthorized decryption of sensitive data, potentially violating confidentiality requirements under GDPR and HIPAA. Organizations using affected versions may face compliance risks if exploited.

Mitigation Strategies

Upgrade the cryptography package to version 50.0.0 or later. Disable or restrict services that auto-decrypt untrusted EnvelopedData, especially S/MIME gateways or mail filters. Ensure linked libraries (OpenSSL, LibreSSL, BoringSSL) use implicit rejection to prevent oracle attacks.

Hi! I’m here to help you understand CVE-2026-69247. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70