pyca cryptography up to 48.x build_chain_inner resource consumption

Summaryinfo

A vulnerability was found in pyca cryptography up to 48.x and classified as problematic. This affects the function build_chain_inner. Executing a manipulation can lead to resource consumption. This vulnerability is registered as CVE-2026-69249. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability has been found in pyca cryptography up to 48.x and classified as problematic. This vulnerability affects the function build_chain_inner. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.

The advisory is available at github.com. This vulnerability was named CVE-2026-69249 since 08/03/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 49.0.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• pyca

Name

• cryptography

Version

• 48.x

Website

• Product: https://github.com/pyca/cryptography/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion