GitHub Advisoryadvisory · PyPI

GHSA-8f95-v3jq-cj86 pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

MEDIUM Published 2026-07-09 Modified 2026-07-09 Official page ↗
Aliases
CVE-2026-53720
Ecosystem
PyPI
Packages
pymonocypher
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-122, CWE-1284, CWE-787
Reviewed
2026-07-09

Affected packages

• PyPI pymonocypher: < 4.0.2.8 → fixed in 4.0.2.8

Description

Impact The argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will write past the end of the buffer and possibly corrupt the heap. Patches Fixed in 4.0.2.8, which now verifies that nb_blocks is large enough. See 90ff5b1. Workarounds Provide a correctly sized nb_blocks buffer. pymonocypher thanks Haris (hextheshadow) for the vulnerability report, details, and recommended fix.

Related

Alias · CVE (1)

  • CVE-2026-53720 pymonocypher uses cython to wrap the Monocypher C library. vulnerability

Weakness · CWE (3)

  • CWE-122 Heap-based Buffer Overflow weakness
  • CWE-1284 Improper Validation of Specified Quantity in Input weakness
  • CWE-787 Out-of-bounds Write weakness

References