CVE-2026-69248: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
(updated )
If an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography’s verifier accepts which allows escaping outside of the permitted names.
References
- github.com/advisories/GHSA-m2h6-j472-rp4c
- github.com/pyca/cryptography/commit/286c89128
- github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2
- github.com/pyca/cryptography/pull/14888
- github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c
- github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3554.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-69248
Code Behaviors & Features
Detect and mitigate CVE-2026-69248 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →