Catálogo de CVE

CVE-2026-34073

cryptography is a package designed to expose…

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

Gravedad: Low · CVSS 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: Mar 27, 2026, 7:56:21 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.22% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	python-cryptography	`46.0.6-1`	FixedDistribution-reported fixed boundary	[CVE-2026-34073]
Debiansid	python-cryptography	`49.0.0-2`	Fixed	[CVE-2026-34073]
Debianforky	python-cryptography	`46.0.6-1`	FixedDistribution-reported fixed boundary	[CVE-2026-34073]
Debianforky	python-cryptography	`49.0.0-2`	Fixed	[CVE-2026-34073]

Showing 4 fix observations. All 17 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	cryptography	`46.0.6`	UnknownSource applicability is not established	Provider not reported
PyPIRelease not reported	cryptography	`46.0.6`	UnknownSource applicability is not established	GHSA-M959-CC7F-WV43
UnknownRelease not reported	python-cryptography	Not reported	UnknownSource applicability is not established	Provider not reported
Alpine3.23	py3-cryptography	`46.0.7-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2026-34073]Oct 1, 2026, 2:17:49 AM UTC
Alpine3.24	py3-cryptography	`46.0.7-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2026-34073]Oct 1, 2026, 2:17:49 AM UTC
Debianbookworm	python-cryptography	Not reported	AffectedDistribution reports no fix	[CVE-2026-34073]
Debianbookworm	python-cryptography	`38.0.4-3+deb12u1`	Affected	[CVE-2026-34073]
Debianbookworm-security	python-cryptography	`38.0.4-3~deb12u1`	Affected	[CVE-2026-34073]
Debianforky	python-cryptography	`46.0.6-1`	FixedDistribution-reported fixed boundary	[CVE-2026-34073]
Debianforky	python-cryptography	`49.0.0-2`	Fixed	[CVE-2026-34073]
Debiansid	python-cryptography	`46.0.6-1`	FixedDistribution-reported fixed boundary	[CVE-2026-34073]
Debiansid	python-cryptography	`49.0.0-2`	Fixed	[CVE-2026-34073]
Debiantrixie	python-cryptography	Not reported	AffectedDistribution reports no fix	[CVE-2026-34073]
Debiantrixie	python-cryptography	`43.0.0-3+deb13u1`	Affected	[CVE-2026-34073]
Opensusetumbleweed	python-cryptography	`46.0.6-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:10454-1]Mar 29, 2026, 10:46:08 AM UTC
Suselinux micro 6.0	python-cryptography	`42.0.4-4.1`	UnknownSource applicability is not established	[SUSE-SU-2026:21126-1]Apr 18, 2026, 6:24:57 PM UTC
Suselinux micro 6.1	python-cryptography	`42.0.4-slfo.1.1_4.1`	UnknownSource applicability is not established	[SUSE-SU-2026:21116-1]Apr 18, 2026, 6:26:01 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "python-cryptography",
      "status": "fixed",
      "release": "sid",
      "version": "49.0.0-2"
    },
    {
      "name": "python-cryptography",
      "status": "fixed",
      "release": "forky",
      "version": "49.0.0-2"
    },
    {
      "name": "python-cryptography",
      "status": "vulnerable",
      "release": "trixie",
      "version": "43.0.0-3+deb13u1"
    },
    {
      "name": "python-cryptography",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "38.0.4-3+deb12u1"
    },
    {
      "name": "python-cryptography",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "38.0.4-3~deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "python-cryptography",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "46.0.6-1"
    },
    {
      "bug": null,
      "name": "python-cryptography",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "46.0.6-1"
    },
    {
      "bug": null,
      "name": "python-cryptography",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "python-cryptography",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "python-cryptography",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "cryptography",
      "fixed_version": "46.0.6",
      "applicability_unknown": true
    },
    {
      "name": "cryptography",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "46.0.6"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "46.0.6",
      "provider_record_id": "GHSA-M959-CC7F-WV43",
      "applicability_unknown": true
    },
    {
      "name": "cryptography",
      "ranges": [
        {
          "fixed": "46.0.6",
          "introduced": "",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34073",
      "fixed_version": "46.0.6",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-34073",
      "provider_updated_at": "2026-10-14T17:18:28.637"
    },
    {
      "name": "py3-cryptography",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "46.0.7-r0"
            }
          ]
        }
      ],
      "release": "3.23",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2026-34073",
      "fixed_version": "46.0.7-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2026-34073",
      "provider_updated_at": "2026-10-01T02:17:49.252025721Z",
      "applicability_unknown": true
    },
    {
      "name": "py3-cryptography",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "46.0.7-r0"
            }
          ]
        }
      ],
      "release": "3.24",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2026-34073",
      "fixed_version": "46.0.7-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2026-34073",
      "provider_updated_at": "2026-10-01T02:17:49.252025721Z",
      "applicability_unknown": true
    },
    {
      "name": "python-cryptography",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "42.0.4-slfo.1.1_4.1"
            }
          ]
        }
      ],
      "release": "linux micro 6.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:21116-1",
      "fixed_version": "42.0.4-slfo.1.1_4.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:21116-1",
      "provider_updated_at": "2026-04-18T18:26:01.132653Z",
      "applicability_unknown": true
    },
    {
      "name": "python-cryptography",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "42.0.4-4.1"
            }
          ]
        }
      ],
      "release": "linux micro 6.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:21126-1",
      "fixed_version": "42.0.4-4.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:21126-1",
      "provider_updated_at": "2026-04-18T18:24:57.682434Z",
      "applicability_unknown": true
    },
    {
      "name": "python-cryptography",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "46.0.6-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:10454-1",
      "fixed_version": "46.0.6-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:10454-1",
      "provider_updated_at": "2026-03-29T10:46:08.148424Z",
      "applicability_unknown": true
    }
  ]
}

Publisher notes

[trixie] python-cryptography: Minor issue [bookworm] python-cryptography: Minor issue

OpenFactory catalog packages

La asociación de paquetes está en curso.

[Debian 12 (Bookworm)]

[python3-cryptography]Desconocido
Paquete fuente: [python-cryptography]
Detalles (4)
- 38.0.4-3+deb12u1 · amd64 · bookworm
  Afectada
  nvd · python-cryptography · debian · bookworm
- 38.0.4-3+deb12u1 · arm64 · bookworm
  Afectada
  nvd · python-cryptography · debian · bookworm
- 38.0.4-3~deb12u1 · amd64 · bookworm-security
  Afectada
  nvd · python-cryptography · debian · bookworm
- 38.0.4-3~deb12u1 · arm64 · bookworm-security
  Afectada
  nvd · python-cryptography · debian · bookworm
[python-cryptography-doc]Desconocido
Paquete fuente: [python-cryptography]
Detalles (2)
- 38.0.4-3+deb12u1 · all · bookworm
  Afectada
  nvd · python-cryptography · debian · bookworm
- 38.0.4-3+deb12u1 · all · bookworm
  Afectada
  nvd · python-cryptography · debian · bookworm

[openSUSE Tumbleweed]

[python313-cryptography]Desconocido
Paquete fuente: [python-cryptography]
Detalles (1)
- 50.0.0-1.1 · x86_64 · tumbleweed
  Desconocido · Corregida: 46.0.6-1.1
  Version impact unknown
  nvd · python-cryptography · opensuse · tumbleweed
[python314-cryptography]Desconocido
Paquete fuente: [python-cryptography]
Detalles (1)
- 50.0.0-1.1 · x86_64 · tumbleweed
  Desconocido · Corregida: 46.0.6-1.1
  Version impact unknown
  nvd · python-cryptography · opensuse · tumbleweed

Observado: Oct 23, 2026, 10:36:27 PM UTC

Referencias

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]