CVE-2026-34073: cryptography Package Suffers from Incomplete DNS Name Constraint Enforcement
Summary
CVE-2026-34073: cryptography has incomplete DNS name constraint enforcement on peer names. Affects cryptography versions < 46.0.6. Fixed in 46.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cryptography package is a widely used library in Python for cryptographic operations, including encryption, decryption, and secure communication. It provides essential functionalities for developers to implement secure protocols and handle cryptographic data. However, prior to version 46.0.5, the package had a vulnerability related to DNS name constraints, which could potentially allow unauthorized access under specific conditions.
Vulnerability Detail
The vulnerability arises from incomplete enforcement of DNS name constraints on peer names during certificate validation. In versions prior to 46.0.5, the cryptography library only validated DNS name constraints against Subject Alternative Names (SANs) in child certificates, neglecting the peer name presented during validation. This oversight allowed a peer named 'bar.example.com' to validate against a wildcard certificate for '*.example.com', even if the parent certificate contained an excluded subtree constraint for 'bar.example.com'. This gap between RFC 5280 and RFC 9525 led to potential security risks, although exploitation requires an uncommon X.509 topology, making it a medium-to-low impact vulnerability.
How To Fix
Latest published version: 50.0.2 as of 22 Oct 2026
pip install --upgrade "cryptography==50.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
46.0.6
This is the first release that contains the fix.
pip install --upgrade "cryptography==46.0.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability other than upgrading to the patched version.
Conclusion
In summary, CVE-2026-34073 represents a significant vulnerability in the cryptography package due to incomplete DNS name constraint enforcement. Users are strongly advised to upgrade to version 46.0.6 or newer to ensure their applications are secure against potential exploitation.
See every vulnerability recorded for cryptography →
FAQ
CVE-2026-34073 is a vulnerability in the cryptography package that involves incomplete DNS name constraint enforcement, potentially allowing unauthorized certificate validation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 1.7, indicating a low severity level.
While there are no specific workarounds, it is recommended to prioritize upgrading to the patched version as soon as possible to mitigate the risk.
You can find more information about the cryptography package on its official documentation page or its repository on GitHub.
References
Related vulnerabilities
Recent vulnerabilities recorded for cryptography.
