CVE-2026-69248

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-69248", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-03T19:54:19.852Z", "datePublished": "2026-08-03T21:21:43.710Z", "dateUpdated": "2026-09-02T13:26:35.057Z"}, "containers": {"cna": {"title": "python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c"}, {"name": "https://github.com/pyca/cryptography/pull/14888", "tags": ["x_refsource_MISC"], "url": "https://github.com/pyca/cryptography/pull/14888"}, {"name": "https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2", "tags": ["x_refsource_MISC"], "url": "https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2"}], "affected": [{"vendor": "pyca", "product": "cryptography", "versions": [{"version": "< 49.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-02T13:26:35.057Z"}, "descriptions": [{"lang": "en", "value": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0."}], "source": {"advisory": "GHSA-m2h6-j472-rp4c", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T13:34:32.304052Z", "id": "CVE-2026-69248", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T15:04:51.587Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-69248", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T13:34:32.304052Z"}}}], "references": [{"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T13:34:42.076Z"}}], "cna": {"title": "python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees", "source": {"advisory": "GHSA-m2h6-j472-rp4c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "pyca", "product": "cryptography", "versions": [{"status": "affected", "version": "< 49.0.0"}]}], "references": [{"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c", "name": "https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pyca/cryptography/pull/14888", "name": "https://github.com/pyca/cryptography/pull/14888", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2", "name": "https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-02T13:26:35.057Z"}}}, "cveMetadata": {"cveId": "CVE-2026-69248", "state": "PUBLISHED", "dateUpdated": "2026-09-02T13:26:35.057Z", "dateReserved": "2026-08-03T19:54:19.852Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-03T21:21:43.710Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cryptography", "vendor": "pyca", "versions": [{"status": "affected", "version": "< 49.0.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0."}, {"lang": "es", "value": "criptograf\u00eda es un paquete dise\u00f1ado para exponer primitivas y recetas criptogr\u00e1ficas a los desarrolladores de Python. Antes de 49.0.0, si una CA intermedia restringida permite el nombre DNS foo.example.com, y el certificado hoja tiene un comod\u00edn en su SAN DNS de *.example.com, el verificador de python-cryptography lo acepta, lo que permite escapar fuera de los nombres permitidos. El problema principal est\u00e1 en DNSConstraint::matches, donde un patr\u00f3n de comod\u00edn fue tratado como coincidente con una restricci\u00f3n permitida m\u00e1s espec\u00edfica, a pesar de que *.example.com puede expandirse a nombres hermanos como bar.example.com fuera de foo.example.com. Esto permite la aceptaci\u00f3n de una cadena de certificados no v\u00e1lida. Este problema est\u00e1 solucionado en 49.0.0."}], "id": "CVE-2026-69248", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69248", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T13:34:32.304052Z", "version": "2.0.3"}}]}, "published": "2026-08-03T22:16:52.550", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2"}, {"source": "security-advisories@github.com", "url": "https://github.com/pyca/cryptography/pull/14888"}, {"source": "security-advisories@github.com", "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,49.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cryptography", "source": "cna", "vendor": "pyca"}, "product": "cryptography", "vendor": "pyca"}], "created": "2026-08-03T22:30:02.779618+00:00", "updated": "2026-09-02T15:30:17.739772+00:00", "vendors": ["pyca", "pyca$PRODUCT$cryptography"]}