CVE-2026-69248

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.

References

• https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2
• https://github.com/pyca/cryptography/pull/14888
• https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c
• https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c