Ghostwire

CVE-2026-69247: cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

HIGH CVSS 0.0 Exploit Available

Published: August 3, 2026 | Last Modified: August 3, 2026

Description

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Ghostwire Analysis — What This Means Practically

Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

References

github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5
github.com/pyca/cryptography/pull/15369
github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f
github.com/advisories/GHSA-g6cj-pr64-35w5
www.tenable.com/cve/CVE-2026-69247
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-69247