CVE-2026-34073

Name
CVE-2026-34073
Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:* py3-cryptography >= None < 46.0.6

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
py3-cryptography edge-main 46.0.7-r0 Duncan Bellamy <dunk@denkimushi.com> fixed
py3-cryptography edge-main 46.0.5-r1 Duncan Bellamy <dunk@denkimushi.com> possibly vulnerable
py3-cryptography edge-main 46.0.5-r0 Duncan Bellamy <dunk@denkimushi.com> possibly vulnerable
py3-cryptography edge-main 46.0.3-r0 Duncan Bellamy <dunk@denkimushi.com> possibly vulnerable
py3-cryptography edge-main 46.0.2-r0 Duncan Bellamy <dunk@denkimushi.com> possibly vulnerable
py3-cryptography edge-main 44.0.3-r0 Duncan Bellamy <dunk@denkimushi.com> possibly vulnerable
py3-cryptography edge-main 41.0.2-r0 None possibly vulnerable
py3-cryptography edge-main 39.0.1-r0 None possibly vulnerable
py3-cryptography edge-main 3.3.2-r0 None possibly vulnerable
py3-cryptography edge-main 3.2.2-r0 None possibly vulnerable
py3-cryptography edge-main 3.2.1-r0 None possibly vulnerable
py3-cryptography edge-community 44.0.3-r0 Duncan Bellamy <dunk@denkimushi.com> possibly vulnerable
py3-cryptography edge-community 44.0.2-r0 Duncan Bellamy <dunk@denkimushi.com> possibly vulnerable
py3-cryptography edge-community 44.0.1-r0 Duncan Bellamy <dunk@denkimushi.com> possibly vulnerable
py3-cryptography edge-community 44.0.0-r0 Duncan Bellamy <dunk@denkimushi.com> possibly vulnerable
py3-cryptography edge-community 41.0.2-r0 psykose <alice@ayaya.dev> possibly vulnerable
py3-cryptography edge-community 39.0.1-r0 psykose <alice@ayaya.dev> possibly vulnerable
py3-cryptography edge-community 3.2.2-r0 None possibly vulnerable
py3-cryptography edge-community 3.2.1-r0 None possibly vulnerable
py3-cryptography 3.23-main 46.0.7-r0 Duncan Bellamy <dunk@denkimushi.com> fixed
py3-cryptography 3.23-main 46.0.5-r0 Duncan Bellamy <dunk@denkimushi.com> possibly vulnerable
py3-cryptography 3.23-main 46.0.3-r0 Duncan Bellamy <dunk@denkimushi.com> possibly vulnerable