--- id: CVE-2026-69249 title: >- python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers summary: >- python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed cert… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-400 - CWE-770 vendor: Red Hat product: Red Hat Enterprise Linux AppStream (v. 10) affected: - enterprise_linux 10 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_9 - hardened_images patched: - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_9 - hardened_images published: '2026-08-03' updated: '2026-09-10' sourceUpdated: '2026-09-10T20:36:14.340' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69249' references: - url: 'https://github.com/pyca/cryptography/commit/3763aa79b' label: security-advisories@github.com - url: >- https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582 label: security-advisories@github.com - url: 'https://github.com/pyca/cryptography/pull/14960' label: security-advisories@github.com - url: >- https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww label: security-advisories@github.com - url: >- https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml label: security-advisories@github.com - url: >- https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69249.json - url: 'https://access.redhat.com/security/cve/CVE-2026-69249' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2510815' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-69249' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69249' - url: 'https://access.redhat.com/errata/RHSA-2026:64795' - url: 'https://access.redhat.com/errata/RHSA-2026:64774' - url: 'https://access.redhat.com/errata/RHSA-2026:55543' - url: 'https://github.com/advisories/GHSA-jwv3-5hgf-82ww' - url: 'https://github.com/pyca/cryptography' - url: 'https://access.redhat.com/errata/RHSA-2026:70965' - url: 'https://access.redhat.com/errata/RHSA-2026:70979' - url: 'https://access.redhat.com/errata/RHSA-2026:70995' - url: 'https://access.redhat.com/errata/RHSA-2026:70969' - url: 'https://access.redhat.com/errata/RHSA-2026:71659' - url: 'https://access.redhat.com/errata/RHSA-2026:71658' tags: - nvd - csaf - vex - red-hat - ghsa - pip - osv epss: 0.00332 epssPercentile: 0.2359 aliases: - GHSA-jwv3-5hgf-82ww - PYSEC-2026-3553 ecosystem: pip cvssSource: vendor ingestedAt: '2026-08-03T21:30:01.414Z' --- ## Overview python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-69249) Affected packages: - `cryptography <= 48.0.0` Patched in: - `cryptography 49.0.0` Source: https://github.com/advisories/GHSA-jwv3-5hgf-82ww ## Vendor advisories - **RHSA-2026:64795** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64795) - **RHSA-2026:64774** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64774) - **RHSA-2026:55543** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55543) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69249.json) - **RHSA-2026:70965** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70965) - **RHSA-2026:70979** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70979) - **RHSA-2026:70995** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70995) - **RHSA-2026:70969** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70969) - **RHSA-2026:71659** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71659) - **RHSA-2026:71658** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71658)