CVE catalog
CVE-2026-69248
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.ex
- Severity
- High · CVSS 7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.24% · Oct 25, 2026
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-cryptography | sid | 49.0.0-2 | fixed |
| Debian | python-cryptography | forky | 49.0.0-2 | fixed |
| Debian | python-cryptography | trixie | 43.0.0-3+deb13u1 | vulnerable |
| Debian | python-cryptography | bookworm | 38.0.4-3+deb12u1 | vulnerable |
| Debian | python-cryptography | bookworm-security | 38.0.4-3~deb12u1 | vulnerable |
| PyPI | cryptography | Not reported | 49.0.0 | fixed |
| Pip | cryptography | Not reported | 49.0.0 | fixed |
| Ubuntu | python-cryptography | 26.04 | 43.0.0-1ubuntu1 | vulnerable |
| Ubuntu | python-cryptography | 26.04 | 46.0.1-1ubuntu2 | vulnerable |
| Ubuntu | python-cryptography | 26.04 | 46.0.5-1ubuntu1 | vulnerable |
| Ubuntu | python-cryptography | 26.04 | 46.0.5-1ubuntu2 | vulnerable |
| Ubuntu | python-cryptography | 26.04 | 46.0.5-1ubuntu2.2 | fixed |
| Suse | python-cryptography | linux micro 6.0 | 42.0.4-6.1 | fixed |
| Suse | python-cryptography | linux micro 6.1 | 42.0.4-slfo.1.1_6.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-cryptography | source | sid | 49.0.0-1 | not yet assigned | Not reported | Not reported |
| Debian | python-cryptography | source | forky | 49.0.0-1 | not yet assigned | Not reported | Not reported |
| Debian | python-cryptography | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | python-cryptography | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| PyPI | cryptography | PyPI | Not reported | 49.0.0 | Not reported | PYSEC-2026-3554 | Not reported |
| Pip | cryptography | pip | Not reported | 49.0.0 | Not reported | GHSA-M2H6-J472-RP4C | Not reported |
| Ubuntu | python-cryptography | deb | 26.04 | 46.0.5-1ubuntu2.2 | Not reported | UBUNTU-CVE-2026-69248 | Not reported |
| Suse | python-cryptography | rpm | linux micro 6.0 | 42.0.4-6.1 | Not reported | SUSE-SU-2026:23247-1 | Not reported |
| Suse | python-cryptography | rpm | linux micro 6.1 | 42.0.4-slfo.1.1_6.1 | Not reported | SUSE-SU-2026:23196-1 | Not reported |
Notes
[trixie] python-cryptography: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-cryptography]Affected
Source package: [python-cryptography]
Details (4)
38.0.4-3+deb12u1· amd64 · bookwormAffected
nvd · python-cryptography · debian · bookworm; nvd · python-cryptography · debian · 12
38.0.4-3+deb12u1· arm64 · bookwormAffected
nvd · python-cryptography · debian · bookworm; nvd · python-cryptography · debian · 12
38.0.4-3~deb12u1· amd64 · bookworm-securityAffected
nvd · python-cryptography · debian · bookworm; nvd · python-cryptography · debian · 12
38.0.4-3~deb12u1· arm64 · bookworm-securityAffected
nvd · python-cryptography · debian · bookworm; nvd · python-cryptography · debian · 12
- [python-cryptography-doc]Affected
Source package: [python-cryptography]
Details (2)
38.0.4-3+deb12u1· all · bookwormAffected
nvd · python-cryptography · debian · bookworm; nvd · python-cryptography · debian · 12
38.0.4-3+deb12u1· all · bookwormAffected
nvd · python-cryptography · debian · bookworm; nvd · python-cryptography · debian · 12
[Debian 13 (Trixie)]
- [python3-cryptography]Affected
Source package: [python-cryptography]
Details (2)
43.0.0-3+deb13u1· amd64 · trixieAffected
nvd · python-cryptography · debian · 13
43.0.0-3+deb13u1· arm64 · trixieAffected
nvd · python-cryptography · debian · 13
- [python-cryptography-doc]Affected
Source package: [python-cryptography]
Details (2)
43.0.0-3+deb13u1· all · trixieAffected
nvd · python-cryptography · debian · 13
43.0.0-3+deb13u1· all · trixieAffected
nvd · python-cryptography · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23247-1.json]
- [https://github.com/advisories/GHSA-m2h6-j472-rp4c]
- [https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2]
- [https://github.com/pyca/cryptography/pull/14888]
- [https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-69248]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-69248]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23196-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23247-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-69248]
- [https://security-tracker.debian.org/tracker/CVE-2026-69248]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69248.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3214.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]