PT-2026-28601 · Unknown · Cryptography

1Seal · Published 2026-03-27 · Updated 2026-05-18 · CVE-2026-34073

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions cryptography versions prior to 46.0.5

Description Versions of cryptography before 46.0.5 had a flaw in how DNS name constraints were validated. The validation only checked against Subject Alternative Names (SANs) in child certificates, not the peer name presented during validation. This allowed a peer name like bar.example.com to be accepted by a wildcard leaf certificate for *.example.com, even if a parent certificate excluded bar.example.com. This occurred because of differing interpretations between RFC 5280 and RFC 9525 regarding the application of Name Constraints to peer names.

Recommendations Upgrade to version 46.0.6 or newer.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CLEANSTART-2026-AN27706

CVE-2026-34073

ECHO-4B9F-FBF8-C429

GHSA-M959-CC7F-WV43

OPENSUSE-SU-2026:10454-1

OPENSUSE-SU-2026:20506-1

PYSEC-2026-35

RHSA-2026:7295

SUSE-SU-2026:21021-1

SUSE-SU-2026:21116-1

SUSE-SU-2026:21126-1

SUSE-SU-2026:21165-1

Affected Products

Cryptography

References · 80

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34073.json · Exploit
• https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-34073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33175 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:21126-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10454-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22815 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34525 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44432 · Security Note
• https://osv.dev/vulnerability/GHSA-m959-cc7f-wv43 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34052 · Security Note