Came across something in uv.lock around line 1 that looked worth flagging.
The project pins cryptography==46.0.3, which is vulnerable to CVE-2026-26007. The affected functions fail to validate that elliptic curve points lie in the correct prime-order subgroup, allowing small‑subgroup attacks that can leak private‑key bits (ECDH) or enable signature forgery (ECDSA). This is a HIGH‑severity issue because it directly compromises confidentiality and integrity of cryptographic operations. Upgrading to cryptography>=46.0.5 eliminates the missing validation.
Something like this might fix it:
```diff
--- a/uv.lock
+++ b/uv.lock
@@
- name = "cryptography"
- version = "46.0.3"
+ name = "cryptography"
+ version = "46.0.5"
```
For reference: rule CVE-2026-26007. Rated high.
I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
uv.lockaround line 1 that looked worth flagging.The project pins cryptography==46.0.3, which is vulnerable to CVE-2026-26007. The affected functions fail to validate that elliptic curve points lie in the correct prime-order subgroup, allowing small‑subgroup attacks that can leak private‑key bits (ECDH) or enable signature forgery (ECDSA). This is a HIGH‑severity issue because it directly compromises confidentiality and integrity of cryptographic operations. Upgrading to cryptography>=46.0.5 eliminates the missing validation.
Something like this might fix it:
For reference: rule
CVE-2026-26007. Rated high.I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.