CVE-2026-69247

Name of the Vulnerable Software and Affected Versions cryptography versions 44.0.0 through 49.9.9

Description The pkcs7 decrypt der, pkcs7 decrypt pem, and pkcs7 decrypt smime functions report the outcome of decrypting a RecipientInfo's encryptedKey in distinguishable ways, including timing differences. This behavior discloses the exact length recovered from the RSA operation, creating a Bleichenbacher oracle against the content-encryption key for applications that decrypt attacker-supplied EnvelopedData and reflect the outcome. The decryption process involves RSA PKCS#1 v1.5 decryption of the encryptedKey, building an AES cipher, and performing AES-CBC decryption with PKCS#7 unpadding. Failures at different stages—invalid RSA padding, valid padding with an incorrect key length, or a correct length with a wrong key—result in different error responses. This is particularly relevant when using linked libraries that lack implicit rejection, such as OpenSSL 3.0, 3.1, LibreSSL, and BoringSSL. Exploitation typically requires a high-volume service that automatically decrypts untrusted EnvelopedData, such as a mail filter or S/MIME gateway.

Recommendations Update cryptography to version 50.0.0.