CVE-2026-53720: pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

July 9, 2026

The argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will write past the end of the buffer and possibly corrupt the heap.

References

github.com/advisories/GHSA-8f95-v3jq-cj86
github.com/jetperch/pymonocypher/commit/90ff5b13b13b5673c372e188f482d8c172e6ab86
github.com/jetperch/pymonocypher/security/advisories/GHSA-8f95-v3jq-cj86
nvd.nist.gov/vuln/detail/CVE-2026-53720

Code Behaviors & Features

Detect and mitigate CVE-2026-53720 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →