Is cryptography healthy, maintained, and safe?
Maintained, but watch it — cryptography has real signals (drift, thin maintenance, or advisories) worth tracking.
The verdict
OSPulse scores cryptography at 55/100 (medium risk), computed deterministically from live PyPI release history, and the OSV vulnerability database. Maintained, but watch it — cryptography has real signals (drift, thin maintenance, or advisories) worth tracking.
Its most recent release shipped on 12 June 2026 — 45 days ago — so development is clearly active. Across 154 releases the cadence has been steady, which is a good sign of an ongoing maintenance rhythm. PyPI doesn't expose a reliable maintainer count, so bus-factor isn't scored here — treat maintenance depth as unknown rather than assumed.
OSV lists 36 known advisories for cryptography, including 10 high. Review whether your version is in the affected range and whether a fixed release is available before depending on it. Each advisory is listed with its OSV/GHSA identifier below.
cryptography is usable but carries real signals — pin versions, watch for new advisories, and keep a fallback in mind. This is a one-time snapshot of a single package — real projects depend on dozens or hundreds of packages, and any one of them can drift or be compromised between releases. Run your own requirements.txt through the free health check, or have OSPulse monitor your whole dependency tree continuously.
Evidence trail — deterministic, auditable
Known vulnerabilities (36)
- GHSA-39hc-v87j-747x ↗MODERATE
Vulnerable OpenSSL included in cryptography wheels
Python Cryptography package vulnerable to Bleichenbacher timing oracle attack
Vulnerable OpenSSL included in cryptography wheels
Vulnerable OpenSSL included in cryptography wheels
cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
Vulnerable OpenSSL included in cryptography wheels
Null pointer dereference in PKCS12 parsing
cryptography mishandles SSH certificates
PyCA Cryptography vulnerable to GCM tag forgery
- GHSA-h4gh-qq45-vh27 ↗MODERATE
pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
RSA decryption vulnerable to Bleichenbacher timing vulnerability
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
pyca/cryptography's wheels include vulnerable OpenSSL
cryptography has incomplete DNS name constraint enforcement on peer names
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
Improper input validation in cryptography
cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
PyCA Cryptography symmetrically encrypting large values can lead to integer overflow
Vulnerable OpenSSL included in cryptography wheels
Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf
Vulnerable OpenSSL included in cryptography wheels
HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer
The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-poin
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificate
Python Cryptography package vulnerable to Bleichenbacher timing oracle attack
Vulnerable OpenSSL included in cryptography wheels
Null pointer dereference in PKCS12 parsing
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), Ellip
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child cert
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Pytho
Vulnerable OpenSSL included in cryptography wheels
Key facts
- Latest version
- v49.0.0
- Last release
- 12 June 2026 (45 days ago)
- Total releases
- 154
- First release
- 8 January 2014
- Package age
- 12.6 years
- Maintainers
- not exposed by PyPI
- Known advisories
- 36
- Confidence
- High
Frequently asked
Is cryptography still maintained?
Yes — cryptography released as recently as 12 June 2026 (45 days ago), so it is actively maintained.
Does cryptography have known security vulnerabilities?
Yes — OSV lists 36 advisories for cryptography. See the advisory list on this page for the OSV/GHSA identifiers.
Is cryptography safe to use?
Maintained, but watch it — cryptography has real signals (drift, thin maintenance, or advisories) worth tracking. OSPulse rates it 55/100 (medium risk) based on release recency, cadence and known vulnerabilities.
Other PyPI packages we've checked
cryptography is one package. What about the other hundreds in your tree?
Paste your own requirements.txt into the free health check for an instant snapshot — or let OSPulse monitor your whole dependency tree continuously, before your CVE scanner wakes up.
Data from the PyPI registry & OSV.dev · snapshot generated 2026-07-27 · scores are deterministic and recomputed on each refresh.