DNS Name Constraints Validation Issue in py3-cryptography Package
Summary
ALPINE-CVE-2026-34073: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Affects py3-cryptography versions < 46.0.7-r0. Fixed in 46.0.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The py3-cryptography package is a widely used library in Python that provides cryptographic primitives and recipes for developers. It enables secure communication and data protection through various cryptographic functions. However, prior to version 46.0.6, the package had a significant vulnerability related to DNS name constraints, which could lead to improper validation of certificates.
Vulnerability Detail
The vulnerability arises from the fact that, before version 46.0.6, the py3-cryptography package only validated DNS name constraints against Subject Alternative Names (SANs) within child certificates. It failed to consider the 'peer name' presented during each validation. This oversight allowed a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the parent certificate contained an excluded subtree constraint for bar.example.com. This could lead to potential security risks, including man-in-the-middle attacks, where an attacker could impersonate a legitimate server.
How To Fix
Minimum fixed version
46.0.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade py3-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to validate DNS names against the expected constraints manually. However, this is not a substitute for updating the package and should only be used until the update can be applied.
Conclusion
In summary, the py3-cryptography package had a vulnerability related to DNS name constraints validation that could allow improper certificate validation. It is crucial to update to version 46.0.7 or later to protect your application from potential security risks. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for py3-cryptography →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
You can use Vulert, which allows you to monitor and alert in real-time for open-source vulnerabilities. By using the Vulert playground, you can check if your application is affected without any signup.
If exploited, this vulnerability could allow attackers to impersonate legitimate servers, leading to man-in-the-middle attacks and unauthorized access to sensitive data.
Yes, you should upgrade to version 46.0.7 or later of the py3-cryptography package to mitigate this vulnerability.
The py3-cryptography package provides cryptographic primitives and recipes, enabling developers to implement secure communication and data protection in their applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for py3-cryptography.
