pyca cryptography up to 48.x Certificate Verifier DNSConstraint::matches certificate validation

Summaryinfo

A vulnerability has been found in pyca cryptography up to 48.x and classified as problematic. The impacted element is the function DNSConstraint::matches of the component Certificate Verifier. Performing a manipulation results in certificate validation. This vulnerability is cataloged as CVE-2026-69248. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in pyca cryptography up to 48.x. This affects the function DNSConstraint::matches of the component Certificate Verifier. The manipulation with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on integrity. The summary by CVE is:

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-69248 since 08/03/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1587.003 for this issue.

Upgrading to version 49.0.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• pyca

Name

• cryptography

Version

• 48.x

Website

• Product: https://github.com/pyca/cryptography/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion