Validation Flaw in pyca/cryptography Exposes Private Keys to Subgroup Attacks

CVE-2026-26007 reveals a critical validation gap in pyca/cryptography, a widely-used Python cryptographic library, that allows attackers to leak private keys through subgroup confinement attacks. With a CVSS score of 8.2, this vulnerability exploits legacy elliptic curves with cofactors greater than 1, enabling attackers to reconstruct private keys via small-order subgroups. Immediate patching to version 46.0.5 is essential for any Python backend relying on ECDH or ECDSA operations.