CVE-2026-69248: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

August 3, 2026

If an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography’s verifier accepts which allows escaping outside of the permitted names.

References

github.com/advisories/GHSA-m2h6-j472-rp4c
github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2
github.com/pyca/cryptography/pull/14888
github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c
nvd.nist.gov/vuln/detail/CVE-2026-69248

Code Behaviors & Features

Detect and mitigate CVE-2026-69248 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →