Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pyca | cryptography | < 46.0.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-cryptography | 46.0.6-1 | — |
| Debian 13 | python-cryptography | No fix yet | — |
| Debian 12 | python-cryptography | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python-cryptography | 46.0.7-1.hum1 | RHSA-2026:7295 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-cryptography | 44.0.3-160000.3.1 | SUSE-SU-2026:21165-1 |
| SLES 16.0 | python-cryptography | 44.0.3-160000.3.1 | SUSE-SU-2026:21165-1 |
| SLE Micro 6.2 | python-cryptography | 44.0.3-160000.3.1 | SUSE-SU-2026:21021-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | python-cryptography | 42.0.4-slfo.1.1_4.1 | SUSE-SU-2026:21116-1 |
| SLE Micro 6.0 | python-cryptography | 42.0.4-4.1 | SUSE-SU-2026:21126-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-cryptography | 46.0.6-1.1 | openSUSE-SU-2026:10454-1 |
| openSUSE Leap 16.0 | python-cryptography | 44.0.3-160000.3.1 | openSUSE-SU-2026:20506-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-cryptography | 46.0.7-r0 | — |
| Alpine v3.23 | py3-cryptography | 46.0.7-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.1.8-r10 | — |
| Wolfi rolling | dask-kubernetes | 2026.3.0-r2 | — |
| Wolfi rolling | datadog-agent-7.72-core-integrations | 7.72.4-r27 | — |
| Wolfi rolling | datadog-agent-7.73-core-integrations | 7.73.3-r23 | — |
| Wolfi rolling | ggshield | 1.49.0-r1 | — |
| Wolfi rolling | in-toto | 3.0.0-r3 | — |
| Wolfi rolling | jupyter-base-notebook | 7.5.5-r1 | — |
| Wolfi rolling | k8s-sidecar | 2.5.1-r2 | — |
| Wolfi rolling | kserve-storage-controller | 0.16.0-r24 | — |
| Wolfi rolling | kubeflow-jupyter-web-app | 1.10.0-r13 | — |
| Wolfi rolling | kubeflow-volumes-web-app | 1.10.0-r12 | — |
| Wolfi rolling | mitmproxy | 12.2.1-r0 | — |
| Wolfi rolling | mycli | 1.67.1-r0 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.27.0-r6 | — |
| Wolfi rolling | semgrep | 1.157.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cryptography | < 46.0.6 | 46.0.6 | GHSA-m959-cc7f-wv43 |
Advisories 9
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-1434 IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- RHSA-2026:7295 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:20506-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21165-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21116-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Apr 18, 2026
- SUSE-SU-2026:21126-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Apr 18, 2026
- SUSE-SU-2026:21021-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Apr 14, 2026
- openSUSE-SU-2026:10454-1 python311-cryptography-46.0.6-1.1 on GA media SUSE / openSUSE Security Updates · Mar 29, 2026