# cryptography: what changed from 49 to 50

- Product: cryptography (https://whatsnew.fyi/product/cryptography)
- Vendor: cryptography
- Range: changelog entries numbered after 49.0.0 up to and including 50.0.1, stable releases only
- Entries below: 2 releases (newest first)
- Resolved: 49 is 49.0.0 and 50 is 50.0.1, the newest stable release of each major we track
- Carrying security changes: 1 · CVEs mentioned: 1 · Mentioning breaking changes: 0 · Removing or deprecating something: 1
- Page: https://whatsnew.fyi/product/cryptography/compare/49...50

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (16 changes, grouped by kind)

### Added

#### 50.0.0 (2026-07-31)

- Added xof() class methods to SHAKE128 and SHAKE256 for constructing algorithm instances configured for use with XOFHash
- Added the Cobblestone (streaming symmetric encryption) recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification for streaming authenticated encryption of large messages
- Added support for using Name as a field type in the ASN.1 module
- Added MLDSAMuHasher for incrementally computing the ML-DSA mu (message representative) used by the external-mu signing and verification APIs

### Changed

#### 50.0.0 (2026-07-31)

- X.509 verification APIs are now considered stable and are subject to the API stability policy
- XOFHash is now supported when building against AWS-LC
- HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC
- Diffie-Hellman key exchange is now supported when building against AWS-LC
- The builtin HashAlgorithm classes and the classes in padding can now be compared with ==

### Fixed

#### 50.0.0 (2026-07-31)

- Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT
- Loading a public key or an EC private key now rejects DER where the subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number of unused bits
- Parsing a CRL entry's InvalidityDate extension now rejects a GeneralizedTime that carries fractional seconds or another non-DER form
- load_der_ocsp_request() and load_der_ocsp_response() now reject a request or response whose version field is not v1, the only version defined by RFC 6960
- load_der_public_key() and load_pem_public_key() now reject Diffie-Hellman public keys whose modulus is smaller than 512 bits

### Deprecated

#### 50.0.0 (2026-07-31)

- Diffie-Hellman key exchange over finite fields (FFDH) is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs

### Security

#### 50.0.0 (2026-07-31)

- pkcs7_decrypt_der() and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo's encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages, by substituting a random key on failure as described in RFC 3218

_One release carries no categorized changes yet: 50.0.1._

## Release notes

### 50.0.1

- Date: 2026-08-25
- Version: 50.0.1
- Original notes: https://pypi.org/project/cryptography/50.0.1/
- Permalink: https://whatsnew.fyi/product/cryptography/releases/50.0.1

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.

### 50.0.0

- Date: 2026-07-31
- Version: 50.0.0
- Original notes: https://pypi.org/project/cryptography/50.0.0/
- Permalink: https://whatsnew.fyi/product/cryptography/releases/50.0.0

- **security** — pkcs7_decrypt_der() and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo's encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages, by substituting a random key on failure as described in RFC 3218
- **deprecated** — Diffie-Hellman key exchange over finite fields (FFDH) is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs
- **added** — Added xof() class methods to SHAKE128 and SHAKE256 for constructing algorithm instances configured for use with XOFHash
- **changed** — X.509 verification APIs are now considered stable and are subject to the API stability policy
- **added** — Added the Cobblestone (streaming symmetric encryption) recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification for streaming authenticated encryption of large messages
- **fixed** — Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT
- **added** — Added support for using Name as a field type in the ASN.1 module
- **fixed** — Loading a public key or an EC private key now rejects DER where the subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number of unused bits
- **fixed** — Parsing a CRL entry's InvalidityDate extension now rejects a GeneralizedTime that carries fractional seconds or another non-DER form
- **fixed** — load_der_ocsp_request() and load_der_ocsp_response() now reject a request or response whose version field is not v1, the only version defined by RFC 6960
- **changed** — XOFHash is now supported when building against AWS-LC
- **changed** — HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC
- **changed** — Diffie-Hellman key exchange is now supported when building against AWS-LC
- **fixed** — load_der_public_key() and load_pem_public_key() now reject Diffie-Hellman public keys whose modulus is smaller than 512 bits
- **added** — Added MLDSAMuHasher for incrementally computing the ML-DSA mu (message representative) used by the external-mu signing and verification APIs
- **changed** — The builtin HashAlgorithm classes and the classes in padding can now be compared with ==

* **SECURITY ISSUE**: [pkcs7\_decrypt\_der()](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/serialization/#cryptography.hazmat.primitives.serialization.pkcs7.pkcs7%5Fdecrypt%5Fder "cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der")and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a `RecipientInfo`’s `encryptedKey`, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in [**RFC 3218**](https://datatracker.ietf.org/doc/html/rfc3218.html). Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in `cryptography.hazmat.primitives.asymmetric.dh` and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm.
* Added `xof()` class methods to [SHAKE128](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#cryptography.hazmat.primitives.hashes.SHAKE128 "cryptography.hazmat.primitives.hashes.SHAKE128") and [SHAKE256](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#cryptography.hazmat.primitives.hashes.SHAKE256 "cryptography.hazmat.primitives.hashes.SHAKE256") for constructing algorithm instances configured for use with [XOFHash](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#cryptography.hazmat.primitives.hashes.XOFHash "cryptography.hazmat.primitives.hashes.XOFHash").
* The [X.509 verification](https://cryptography.io/en/latest/x509/verification/#module-cryptography.x509.verification "cryptography.x509.verification") APIs are now considered stable and are subject to our API stability policy.
* Added the [Cobblestone (streaming symmetric encryption)](https://cryptography.io/en/latest/cobblestone/) recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the [C2SP chunked-encryption specification](https://c2sp.org/chunked-encryption) for streaming authenticated encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them.
* Added support for using [Name](https://cryptography.io/en/latest/x509/reference/#cryptography.x509.Name "cryptography.x509.Name") as a field type in the [ASN.1](https://cryptography.io/en/latest/hazmat/asn1/) module.
* Loading a public key or an EC private key now rejects DER where the `subjectPublicKey` (or EC `publicKey`) `BIT STRING` declares a non-zero number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry’s `InvalidityDate` extension now rejects a `GeneralizedTime` that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field.
* [load\_der\_ocsp\_request()](https://cryptography.io/en/latest/x509/ocsp/#cryptography.x509.ocsp.load%5Fder%5Focsp%5Frequest "cryptography.x509.ocsp.load_der_ocsp_request") and [load\_der\_ocsp\_response()](https://cryptography.io/en/latest/x509/ocsp/#cryptography.x509.ocsp.load%5Fder%5Focsp%5Fresponse "cryptography.x509.ocsp.load_der_ocsp_response") now reject a request or response whose `version` field is not `v1`, the only version defined by RFC 6960, matching the version validation already performed when loading certificates, CSRs and CRLs.
* [XOFHash](https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#cryptography.hazmat.primitives.hashes.XOFHash "cryptography.hazmat.primitives.hashes.XOFHash") is now supported when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC.
* Diffie-Hellman ([Diffie-Hellman key exchange](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dh/)) is now su

_[Truncated at 4000 characters — full notes: https://pypi.org/project/cryptography/50.0.0/]_