CVE-2026-69248
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
| CWE | CWE-295 |
| Vendor | pyca |
| Product | cryptography |
| Published | Aug 3, 2026 |
Get instant alerts for pyca cryptography
Be the first to know when new unknown vulnerabilities affecting pyca cryptography are published — delivered to Slack, Telegram or Discord.