Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pyca | cryptography | < 49.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-cryptography | 49.0.0-1 | — |
| Debian 13 | python-cryptography | No fix yet | — |
| Debian 12 | python-cryptography | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | python-cryptography | 46.0.5-1ubuntu2.2 | USN-8776-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | python-cryptography | 2.1.4-1ubuntu1.4+esm6 | USN-8776-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | python3.14-cryptography | 45.0.4-4.el10_2.5 | RHSA-2026:64795 |
| RHEL 9 | python3.14-cryptography | 45.0.4-4.el9_8.6 | RHSA-2026:64774 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python-cryptography +1 | 50.0.0-1.hum1 | RHSA-2026:55543 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | python3.14-cryptography | 45.0.4-4.el10_2.5 | ALSA-2026:64795 |
| AlmaLinux 9 | python3.14-cryptography | 45.0.4-4.el9_8.6 | ALSA-2026:64774 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | python3.14-cryptography | 45.0.4-4.el10_2.5 | RLSA-2026:64795 |
| Rocky Linux 9 | python3.14-cryptography | 45.0.4-4.el9_8.6 | RLSA-2026:64774 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-cryptography | 44.0.3-160000.5.1 | SUSE-SU-2026:23570-1 |
| SLES 16.0 | python-cryptography | 44.0.3-160000.5.1 | SUSE-SU-2026:23570-1 |
| SLE Micro 6.2 | python-cryptography | 44.0.3-160000.5.1 | SUSE-SU-2026:23404-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | python-cryptography | 42.0.4-slfo.1.1_6.1 | SUSE-SU-2026:23196-1 |
| SLE Micro 6.0 | python-cryptography | 42.0.4-6.1 | SUSE-SU-2026:23247-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | matrix-synapse | 1.163.0-1.1 | openSUSE-SU-2026:12133-1 |
| openSUSE Leap 16.0 | python-cryptography | 44.0.3-160000.5.1 | openSUSE-SU-2026:21685-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | az | 2.91.0-r0 | — |
| Wolfi rolling | kserve-storage-controller | 0.20.0-r7 | — |
| Wolfi rolling | superset-6.0 +3 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cryptography | >= 45.0.0, < 49.0.0 | 49.0.0 | GHSA-m2h6-j472-rp4c |
| PyPI | cryptography | < 49.0.0 | 49.0.0 | PYSEC-2026-3554 |
Advisories 15
- ALSA-2026:64774 Important: python3.14-cryptography security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:64795 Important: python3.14-cryptography security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-3214 Red Hat Enterprise Linux (python-cryptography): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026
- RHSA-2026:55543 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:12133-1 matrix-synapse-1.163.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 15, 2026
- RHSA-2026:64795 Red Hat Security Advisory: python3.14-cryptography security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:64774 Red Hat Security Advisory: python3.14-cryptography security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SUSE-SU-2026:23570-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Sep 29, 2026
- USN-8776-1 python-cryptography vulnerabilities Ubuntu Security Notices (USN) · Sep 17, 2026
- SUSE-SU-2026:23404-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Sep 10, 2026
- RLSA-2026:64795 Important: python3.14-cryptography security update Rocky Linux Security Advisories · Sep 9, 2026
- RLSA-2026:64774 Important: python3.14-cryptography security update Rocky Linux Security Advisories · Sep 9, 2026
- openSUSE-SU-2026:21685-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Aug 31, 2026
- SUSE-SU-2026:23247-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Aug 27, 2026
- SUSE-SU-2026:23196-1 Security update for python-cryptography SUSE / openSUSE Security Updates · Aug 24, 2026