CVE-2026-69248: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
(updated )
If an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography’s verifier accepts which allows escaping outside of the permitted names.
References
- github.com/advisories/GHSA-m2h6-j472-rp4c
- github.com/pyca/cryptography/commit/286c89128
- github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2
- github.com/pyca/cryptography/pull/14888
- github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c
- github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3554.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-69248
Code Behaviors & Features
Detect and mitigate CVE-2026-69248 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →