pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small
Impact
The argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will write past the end of the buffer and possibly corrupt the heap.
Patches
Fixed in 4.0.2.8, which now verifies that nb_blocks is large enough. See 90ff5b1.
Workarounds
Provide a correctly sized nb_blocks buffer.
pymonocypher thanks Haris (hextheshadow) for the vulnerability report, details, and recommended fix.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | pymonocypher | < 4.0.2.8 | 4.0.2.8 |
References
- https://github.com/jetperch/pymonocypher/security/advisories/GHSA-8f95-v3jq-cj86
- https://github.com/jetperch/pymonocypher/commit/90ff5b13b13b5673c372e188f482d8c172e6ab86
- https://github.com/jetperch/pymonocypher
- https://pypi.org/project/pymonocypher
- https://github.com/advisories/GHSA-8f95-v3jq-cj86
- https://nvd.nist.gov/vuln/detail/CVE-2026-53720
- CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-122, CWE-1284, CWE-787- Platform
- Python (PyPI)
- Package
pymonocypher- Disclosed
- 09.07.2026
- Updated
- 11.10.2026 14:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3000 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-8f95-v3jq-cj86 - CC BY 4.0
Vulnerability history: pymonocypher
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.