Vulnerability Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
Related Weaknesses (CWE)
References
- https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcf
- https://github.com/pyca/cryptography/pull/14888
- https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c
- https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c
FAQ
What is CVE-2026-69248?
CVE-2026-69248 is a documented vulnerability. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the...
How severe is CVE-2026-69248?
CVSS scoring is not yet available for CVE-2026-69248. Check NVD for updates.
Is there a patch for CVE-2026-69248?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.