From df145eb272419cd2a9673fcafabb24103e4f3725 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 19 Oct 2026 12:37:54 -0700
Subject: [PATCH 1/2] gh-155426: correctly reject non-bytes keys in
 `hmac.digest` (GH-155427)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This only affects keys of length smaller than the HMAC blocksize
since larger keys are hashed first.
(cherry picked from commit 197d33218f755af0758c83add3956e0bd7ef8657)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
---
 Lib/hmac.py                                                 | 3 +++
 Lib/test/test_hmac.py                                       | 6 ++++++
 .../Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst  | 4 ++++
 3 files changed, 13 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst

diff --git a/Lib/hmac.py b/Lib/hmac.py
index 2d6016cda11c0e5..587aeacdf02cb03 100644
--- a/Lib/hmac.py
+++ b/Lib/hmac.py
@@ -255,6 +255,9 @@ def digest(key, msg, digest):
 
 
 def _compute_digest_fallback(key, msg, digest):
+    if not isinstance(key, (bytes, bytearray)):
+        raise TypeError(f"key: expected bytes or bytearray, "
+                        f"but got {type(key).__name__!r}")
     digest_cons = _get_digest_constructor(digest)
     inner = digest_cons()
     outer = digest_cons()
diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py
index dbce89dffe8c5a9..692e0abbb7efc02 100644
--- a/Lib/test/test_hmac.py
+++ b/Lib/test/test_hmac.py
@@ -1518,6 +1518,12 @@ def test_with_fallback(self):
         finally:
             cache.pop('foo')
 
+    @hashlib_helper.requires_hashdigest("md5")
+    def test_hmac_digest_reject_memoryview_for_key(self):
+        hmac = import_fresh_module("hmac", blocked=["_hashlib", "_hmac"])
+        with self.assertRaises(TypeError):
+            hmac.digest(memoryview(b"small"), b"world", "md5")
+
     @hashlib_helper.requires_openssl_hashdigest("md5")
     @bigmemtest(size=_4G + 5, memuse=2, dry_run=False)
     def test_hmac_digest_overflow_error_openssl_only(self, size):
diff --git a/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst b/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
new file mode 100644
index 000000000000000..f1839defbe56742
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
@@ -0,0 +1,4 @@
+Make sure that the pure Python fallback of :func:`hmac.digest` reject
+keys that are neither :class:`bytes` or :class:`bytearray`. Previously,
+an :exc:`AttributeError` was raised instead of :exc:`TypeError`.
+Patch by Bénédikt Tran.

From 3bfe707cb921e1745b2078cef3916bba626b3837 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 19 Oct 2026 12:39:57 -0700
Subject: [PATCH 2/2] Update
 Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst

---
 .../next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst b/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
index f1839defbe56742..b7424a76ce26ea8 100644
--- a/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
+++ b/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
@@ -1,4 +1,4 @@
-Make sure that the pure Python fallback of :func:`hmac.digest` reject
+Make sure that the pure Python fallback of :func:`hmac.digest` rejects
 keys that are neither :class:`bytes` or :class:`bytearray`. Previously,
 an :exc:`AttributeError` was raised instead of :exc:`TypeError`.
 Patch by Bénédikt Tran.