CVE-2026-26007

CVE-2026-26007 describes a vulnerability in the cryptography Python package (versions prior to 46.0.5) where public key validation functions fail to verify that Elliptic Curve Cryptography (ECC) points belong to the expected prime-order subgroup, specifically impacting SECT curves. This oversight allows attackers to provide public keys from small-order subgroups, potentially leading to information leakage of private keys during ECDH key negotiation or enabling signature forgery in ECDSA. Rated Medium severity (CVSS 6.5), the vulnerability has a network attack vector and low attack complexity, requiring user interaction (UI:R). A successful exploit could result in high confidentiality impact (C:H) by revealing private key information, but no integrity or availability impact. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. While community discussion is minimal, it includes mentions of a fix being implemented on GitHub.