Skip to main content

python-cryptography CVE-2026-69249

| EUVDEUVD-2026-52450 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-08-03 GitHub_M GHSA-jwv3-5hgf-82ww
Denial Of Service Python Cryptography Pyca
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Unauthenticated network submission of certificate chains triggers CPU exhaustion with no confidentiality or integrity impact, scoped to the vulnerable system only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 03, 2026 - 22:17 EUVD
Source Code Evidence Fetched
Aug 03, 2026 - 22:06 vuln.today
Analysis Generated
Aug 03, 2026 - 22:06 vuln.today
CVE Published
Aug 03, 2026 - 21:26 cve.org
HIGH 8.7

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 12 pypi packages depend on cryptography (11 direct, 1 indirect)

Ecosystem-wide dependent count for version 42.0.0.

DescriptionCVE.org

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.

Articles & Coverage 2

News 3 New Python Vulnerabilities - 3 High Severity, 3 With POC Aug 04, 2026 News 3 New Python Vulnerabilities - 3 High Severity, 1 With POC Aug 03, 2026

AnalysisAI

Certificate path building in python-cryptography before 49.0.0 is exploitable as a denial-of-service vector by attackers who can supply crafted X.509 chains containing duplicate self-signed intermediate certificates. The Rust-based build_chain_inner function explores issuer candidates recursively without deduplicating previously analyzed entries, causing computational work to grow exponentially with the number of duplicates present - empirically exceeding 5 seconds per rejection in testing. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the fix shipped in 49.0.0 bounds path-building via a global signature-check budget.

Technical ContextAI

The vulnerable component is the Rust x509-verification crate (cryptography-x509-verification) embedded within the pyca/cryptography Python package, which implements RFC 5280 certificate path validation. CWE-400 (Uncontrolled Resource Consumption) manifests in build_chain_inner: each call to potential_issuers collects all candidate issuers without filtering previously visited ones, so duplicate self-signed certificates in the untrusted intermediate set cause the recursion tree to branch exponentially at each depth level. Although the max_chain_depth policy cap guarantees eventual termination, the exponential fan-out within that bound is sufficient for a DoS amplification. CPE cpe:2.3:a:pyca:cryptography:*:*:*:*:*:*:*:* covers all versions through 48.0.0. The fix (PR #14960, commit 4a12cf49) introduces a global signature-check budget defaulting to 128 operations - matching Go's and rustls-webpki's defaults - and adds AKI/SKI-based candidate ordering to prioritize likely issuers and preserve budget efficiency.

RemediationAI

Upgrade the cryptography package to version 49.0.0 or later via pip install --upgrade cryptography, which introduces the 128-operation signature-check budget that bounds worst-case path-building cost regardless of input structure; this is the only confirmed fix. The upstream patch is in commit 4a12cf49675a184e47f912b00b04f3a629283582 and pull request https://github.com/pyca/cryptography/pull/14960. If immediate upgrade is blocked, the most effective compensating control is to restrict the application so it never passes externally supplied intermediate certificates to the path validator - for example, by disabling TLS client certificate verification, enforcing that all intermediates are sourced from a pinned internal store, or validating chain uniqueness at the application boundary before invocation. These workarounds are fragile and operationally costly; they do not eliminate the root cause and should be treated as temporary bridges to patching.

More in Python

View all
CVE-2025-24016 CRITICAL POC
9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
CVE-2025-27520 CRITICAL POC
9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
CVE-2025-2945 CRITICAL POC
9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
CVE-2013-5093 MEDIUM POC
6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL POC
9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2024-21644 HIGH POC
7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
CVE-2026-33017 CRITICAL POC
9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
CVE-2017-9462 HIGH POC
8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
CVE-2026-49869 CRITICAL POC
10.0 Jun 26

Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to

CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2024-21645 MEDIUM POC
5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected

Share

CVE-2026-69249 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy