Skip to content
OpenAdvisories
High · 8.7 CVE-2026-69249 EUVD-2026-52450GHSA-jwv3-5hgf-82wwPYSEC-2026-3553

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

Published Aug 3, 2026 · Updated Sep 4, 2026 · Assigned by GitHub_M

Vendor: pyca Product: cryptography Package: az Package: cryptography Package: datadog-agent-7.77-core-integrations Package: datadog-agent-7.78-core-integrations Package: datadog-agent-7.79-core-integrations Package: kserve-storage-controller Package: python-cryptography Package: python-cryptography Package: python-cryptography Package: superset-6.0 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu Ecosystem: Wolfi

Description

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.

Affected products

VendorProductAffectedFixed
pyca cryptography >= 42.0.0, < 49.0.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 python-cryptography 49.0.0-1 —
Debian 13 python-cryptography No fix yet —
Debian 12 python-cryptography No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS python-cryptography 46.0.5-1ubuntu2.2 USN-8776-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS python-cryptography 2.1.4-1ubuntu1.4+esm6 USN-8776-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 python-cryptography +1 43.0.0-4.el10_2.5 RHSA-2026:71658
RHEL 10 python3.14-cryptography 45.0.4-4.el10_2.5 RHSA-2026:64795
RHEL 9 python3.14-cryptography 45.0.4-4.el9_8.6 RHSA-2026:64774
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS python-cryptography +1 43.0.0-4.el10_0.1 RHSA-2026:71659
Red Hat Hardened Images 1 python-cryptography +1 50.0.0-1.hum1 RHSA-2026:55543

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 python3-cryptography 43.0.0-4.el10_2.5 ALSA-2026:71658
AlmaLinux 10 python3.14-cryptography 45.0.4-4.el10_2.5 ALSA-2026:64795
AlmaLinux 9 python3.14-cryptography 45.0.4-4.el9_8.6 ALSA-2026:64774

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 python-cryptography 43.0.0-4.el10_2.5 RLSA-2026:71658
Rocky Linux 10 python3.14-cryptography 45.0.4-4.el10_2.5 RLSA-2026:64795
Rocky Linux 9 python3.14-cryptography 45.0.4-4.el9_8.6 RLSA-2026:64774

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 python-cryptography 44.0.3-160000.5.1 SUSE-SU-2026:23570-1
SLES 16.0 python-cryptography 44.0.3-160000.5.1 SUSE-SU-2026:23570-1
SLE Micro 6.2 python-cryptography 44.0.3-160000.5.1 SUSE-SU-2026:23404-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 python-cryptography 42.0.4-slfo.1.1_6.1 SUSE-SU-2026:23196-1
SLE Micro 6.0 python-cryptography 42.0.4-6.1 SUSE-SU-2026:23247-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 python-cryptography 44.0.3-160000.5.1 openSUSE-SU-2026:21685-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-cryptography 42.0.5-6 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 python3-cryptography 43.0.0-4.el10_2.5 ELSA-2026-71658

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling az 2.91.0-r0 —
Wolfi rolling kserve-storage-controller 0.20.0-r7 —
Wolfi rolling superset-6.0 +3 No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI cryptography >= 42.0.0, < 49.0.0 49.0.0 GHSA-jwv3-5hgf-82ww
PyPI cryptography < 49.0.0 49.0.0 PYSEC-2026-3553

Advisories 19

References