PT-2026-67530 · Pypi · Cryptography

CVE-2026-69249 · Published 2026-08-03 · Updated 2026-08-03

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions python-cryptography versions prior to 49.0.0

Description When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. This occurs because the build chain inner() function does not de-duplicate against previously analyzed candidates. An attacker-controlled certificate chain can cause the process to take significant time to reject, which could be used to launch a resource exhaustion denial of service attack. This issue affects the availability of the system, but does not compromise its integrity as the correctness of the validation remains unaffected.

Recommendations Update python-cryptography to version 49.0.0.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-69249

GHSA-JWV3-5HGF-82WW

Affected Products

Cryptography

References · 6

• https://osv.dev/vulnerability/GHSA-jwv3-5hgf-82ww · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-69249 · Security Note
• https://github.com/pyca/cryptography · Note
• https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww · Note
• https://github.com/pyca/cryptography/pull/14960 · Note
• https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582 · Note