CVE-2026-69248 Details
Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
A vulnerability exists in the Python cryptography library, specifically in versions prior to 49.0.0, allowing wildcard DNS names to escape permitted constraints. This issue arises when an intermediate constrained Certificate Authority (CA) permits a specific DNS name, such as 'foo.example.com', while the leaf certificate includes a wildcard in its DNS Subject Alternative Name (SAN) field, like '*.example.com'. The library's verifier incorrectly accepts this configuration, leading to an invalid certificate chain. The flaw is rooted in the 'DNSConstraint::matches' function, where wildcard patterns are misinterpreted as matching more specific constraints, despite the possibility of expanding to sibling names that fall outside the permitted range. This vulnerability has been addressed in version 49.0.0.
Users can upgrade to Python cryptography version 49.0.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | [email protected] |
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |