Read the docs
TI-2026-48587 Aliases CVE-2026-69248GHSA-m2h6-j472-rp4c

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

Priority MEDIUM 64CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
Low · High · None
Fix status
Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00244 15th percentileScored 2026-11-07
Fix Partial cryptography (pyca): 49.0.0cryptography (PyPI): 49.0.0Red Hat: 7 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pycacryptographybefore 49.0.049.0.0Patch availableCNA
—cryptography (PyPI)45.0.0 to before 49.0.049.0.0Patch availableGHSA-m2h6-j472-rp4c
  • cryptography Vendorpyca Affected before 49.0.0 Fixed in 49.0.0 Patch available CNA
  • cryptography (PyPI) Vendor— Affected 45.0.0 to before 49.0.0 Fixed in 49.0.0 Patch available GHSA-m2h6-j472-rp4c

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:*:*:*——Cryptography.io
  • cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:*:*:* Versions — — ·Cryptography.io

Remediation

  • Fix · CNA cryptography (pyca) Fixed in 49.0.0
  • Fix · GHSA-m2h6-j472-rp4c cryptography (PyPI) Fixed in 49.0.0 Advisory →

Red Hat 7 advisories

  • RHSA-2026:70995 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (rocm)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
  • RHSA-2026:70979 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cuda)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
  • RHSA-2026:70969 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (spyre)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
Show 4 more Red Hat advisories
  • RHSA-2026:70965 Released 2026-09-23 · Red Hat rating Important
    Red Hat AI Inference 3.4.5 (cpu)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
  • RHSA-2026:64795 Released 2026-09-08 · Red Hat rating Important
    python3.14-cryptography security update
    • Red Hat Enterprise Linux AppStream (v. 10) python3.14-cryptography-45.0.4-4.el10_2.5
  • RHSA-2026:64774 Released 2026-09-08 · Red Hat rating Important
    python3.14-cryptography security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.14-cryptography-45.0.4-4.el9_8.6
  • RHSA-2026:55543 Released 2026-08-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-cryptography-50.0.0-1.hum1@src, python3-cryptography-50.0.0-1.hum1@aarch64, python3-cryptography-50.0.0-1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat AI Inference Server 3.4Fixed RHSA-2026:70965, RHSA-2026:70969, RHSA-2026:70979, RHSA-2026:70995
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:64795
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:64774
Red Hat Hardened ImagesFixed RHSA-2026:55543
Not affected: 10 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Satellite 6
  • Red Hat Update Infrastructure 4 for Cloud Providers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69248
  2. 2026-10-03 Alias added: GHSA-m2h6-j472-rp4c
  3. 2026-10-08 Affected versions changed · Red Hat
  4. 2026-10-16 Affected versions changed · Red Hat
  5. 2026-10-29 Affected versions changed · Red Hat
  6. 2026-10-30 Affected versions changed · Red Hat
  7. 2026-11-02 Affected versions changed · Red Hat
  8. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

Other 6

  • TI-2026-48588 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVSS 4.0HIGH 8.7
  • TI-2026-48586 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences