cryptography has incomplete DNS name constraint enforcement on peer names
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 1 fixed, 14 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.
Summary
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pyca | cryptography | before 46.0.6 | 46.0.6 | Patch available | CNA |
| — | cryptography (PyPI) | before 46.0.6 | 46.0.6 | Patch available | GHSA-m959-cc7f-wv43 |
- cryptography Vendorpyca Affected before 46.0.6 Fixed in 46.0.6 Patch available CNA
- cryptography (PyPI) Vendor— Affected before 46.0.6 Fixed in 46.0.6 Patch available GHSA-m959-cc7f-wv43
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:* | before 46.0.6 | Vulnerable | Cryptography.io |
- cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:* Versions before 46.0.6 Vulnerable ·Cryptography.io
Remediation
- Fix · CNA cryptography (pyca) Fixed in 46.0.6
- Fix · GHSA-m959-cc7f-wv43 cryptography (PyPI) Fixed in 46.0.6 Advisory →
Red Hat 1 advisory
- RHSA-2026:7295 Released 2026-04-09 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images python-cryptography-46.0.7-1.hum1@src
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Lightspeed Core | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| Pen Drive Powered by Red Hat Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform Ansible Core 2 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:7295 |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-34073
- 2026-10-03 Alias added: GHSA-m959-cc7f-wv43
References
More pyca vulnerabilities
- TI-2026-48588 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVSS 4.0HIGH 8.7
- TI-2026-48587 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees CVSS 4.0MEDIUM 6.9
- TI-2026-48586 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing CVSS 4.0HIGH 8.2
Sources
- CVE-2026-34073 · CVE Program
- CVE-2026-34073 · NVD
- FIRST EPSS
- GHSA-m959-cc7f-wv43 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-34073 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences