CVE-2026-69248

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-69248
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69248.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-69248
Aliases
Downstream
Related
Published
2026-08-03T21:21:43.710Z
Modified
2026-09-04T03:47:26.975409054Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.

Database specific 
{
    "cwe_ids": [
        "CWE-295"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69248.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/pyca/cryptography

Affected ranges

Type
GIT
Repo
https://github.com/pyca/cryptography
Events
Introduced
67840977c95a23d0dcfba154e303014026df0d3e
Fixed
8e03e30e3aae01632a697e903e3593c924f0139d
Fixed
4d035a4225965edeffd312079a510ef25fcfdcb2
Database specific
Show details 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "45.0.0"
        },
        {
            "fixed": "48.0.0"
        }
    ]
}

Affected versions

45.*
45.0.0
46.*
46.0.0
46.0.1
47.*
47.0.0
48.*
48.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69248.json"