Critical Security Update for python3-cryptography: Exponential Path-Building Vulnerability
Summary
ALSA-2026:71658: Important: python-cryptography security update. Affects python3-cryptography versions < 43.0.0-4.el10_2.5. Fixed in 43.0.0-4.el10_2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-cryptography is a widely used library that provides cryptographic recipes and primitives to Python developers. It supports various encryption algorithms and is integral for secure communications and data protection in applications. However, it has been found to have a vulnerability that can lead to severe security risks if not addressed promptly.
Vulnerability Detail
The vulnerability identified as CVE-2026-69249 involves the presence of duplicate self-signed intermediates in the python-cryptography library. This can lead to exponential path-building, which may allow an attacker to exploit the system by creating a denial-of-service condition or bypassing security mechanisms. The issue arises from the library's handling of certificate chains, which can be manipulated to create excessively long paths during validation.
How To Fix
Minimum fixed version
43.0.0-4.el10_2.5
This is the first release that contains the fix.
sudo dnf update python3-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can avoid using self-signed certificates or ensure that your application does not rely on the affected functionality until the package is updated. However, updating to the patched version is the recommended approach.
Conclusion
The python3-cryptography library has a critical vulnerability that requires immediate attention. By updating to the latest patched version, users can protect their applications from potential exploits. It is crucial to stay informed about such vulnerabilities and utilize tools like Vulert to monitor and manage security risks effectively.
See every vulnerability recorded for python3-cryptography →
FAQ
CVE-2026-69249 is a vulnerability in the python-cryptography library that can lead to exponential path-building due to duplicate self-signed intermediates.
If your application uses the python3-cryptography library, it may be susceptible to denial-of-service attacks or other security breaches due to this vulnerability.
If an immediate update is not possible, consider using alternative methods for certificate validation or avoid using self-signed certificates until the update can be applied.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
For more details, refer to the CVE page associated with CVE-2026-69249, which provides in-depth information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for python3-cryptography.
