8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26007

CVE-2026-26007: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26007

CVE-2026-26007:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cryptography	pip	<= 46.0.4	46.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of subgroup validation for elliptic curve public keys, specifically for SECT curves which have a cofactor greater than one. An attacker could provide a public key corresponding to a point on the curve but within a small subgroup. When this weak key is used in cryptographic operations like ECDH or ECDSA, it can leak bits of the victim's private key or allow for signature forgery. The patch addresses this by introducing a new centralized constructor for public keys, ECPublicKey::new, in the Rust backend. This constructor checks if the curve's cofactor is greater than one, and if so, performs an additional validation (ec.check_key()) to ensure the point is in the correct, large prime-order subgroup. All the identified vulnerable functions (EllipticCurvePublicNumbers.public_key, load_der_public_key, load_pem_public_key, and EllipticCurvePublicKey.from_encoded_point) were modified to use this new secure constructor, thus mitigating the vulnerability.

Vulnerable functions

EllipticCurvePublicNumbers.public_key

src/cryptography/hazmat/primitives/asymmetric/ec.py

This function constructs a public key from numerical representations (x, y coordinates). Before the patch, it did not validate that the resulting point belonged to the correct prime-order subgroup for curves with a cofactor greater than 1 (e.g., SECT curves). This allowed an attacker to supply a point from a small-order subgroup, leading to information leakage about the private key during ECDH or allowing ECDSA signature forgeries.

load_der_public_key

src/cryptography/hazmat/primitives/serialization/base.py

This function loads a public key from DER-encoded data. It was vulnerable because the underlying key construction logic failed to perform subgroup validation for SECT curves. An attacker could craft a malicious DER-encoded public key using a point in a small subgroup to exploit the vulnerability.

load_pem_public_key

src/cryptography/hazmat/primitives/serialization/base.py

This function loads a public key from PEM-encoded data. It was vulnerable for the same reason as `load_der_public_key`, as it relied on the same insecure key construction logic that lacked subgroup validation for SECT curves.

EllipticCurvePublicKey.from_encoded_point

src/cryptography/hazmat/primitives/asymmetric/ec.py

This function creates a public key from an encoded point on the curve. It was vulnerable because it didn't validate that the point was in the correct subgroup for curves with a cofactor > 1. An attacker could provide a specially crafted point from a small subgroup to create a weak public key and exploit the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.