Critical Security Update for python3.14-cryptography: Addressing Exponential Path-Building and Wildcard DNS Vulnerabilities
Summary
ALSA-2026:64774: Important: python3.14-cryptography security update. Affects python3.14-cryptography versions < 45.0.4-4.el9_8.6. Fixed in 45.0.4-4.el9_8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. The python3.14-cryptography package provides cryptographic recipes and primitives to Python developers, enabling secure data handling and communication. However, vulnerabilities in this package can lead to significant security risks, particularly in how it handles self-signed certificates and DNS names.
Vulnerability Detail
The vulnerabilities identified in python3.14-cryptography stem from two main issues. The first, CVE-2026-69249, involves duplicate self-signed intermediates that can cause exponential path-building, potentially leading to denial-of-service conditions. The second, CVE-2026-69248, allows the verifier to accept wildcard DNS names, which can escape from permitted subtrees, posing a risk of unauthorized access or data leakage. These vulnerabilities can be exploited by attackers to manipulate cryptographic operations and compromise system security.
How To Fix
Minimum fixed version
45.0.4-4.el9_8.6
This is the first release that contains the fix.
sudo dnf update python3.14-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the use of wildcard DNS names in your configurations until the package can be updated. This can help mitigate the risk of unauthorized access while you prepare for the update.
Conclusion
The vulnerabilities in python3.14-cryptography pose significant risks that can affect the security of applications relying on this package. It is crucial to update to the patched version to mitigate these risks effectively. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring your software remains secure.
See every vulnerability recorded for python3.14-cryptography →
FAQ
The vulnerabilities can lead to denial-of-service attacks and unauthorized access to sensitive data, compromising the security of applications using this package.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities without needing to install any software.
If an immediate update is not possible, implement workarounds such as disabling wildcard DNS names to reduce exposure to the vulnerabilities.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests they could be leveraged by attackers to disrupt services or gain unauthorized access.
Detailed information can be found on the CVE pages for CVE-2026-69248 and CVE-2026-69249, which provide insights into the vulnerabilities and their implications.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-cryptography.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
