Critical Security Update for python3.14-cryptography: Addressing Exponential Path-Building and Wildcard DNS Vulnerabilities
Summary
ALSA-2026:64795: Important: python3.14-cryptography security update. Affects python3.14-cryptography versions < 45.0.4-4.el10_2.5. Fixed in 45.0.4-4.el10_2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3.14-cryptography is a widely used library in Python that provides cryptographic recipes and primitives to developers. It supports various encryption algorithms and is essential for secure data transmission and storage. However, vulnerabilities in this library can lead to severe security risks, including unauthorized access and data breaches.
Vulnerability Detail
The vulnerabilities identified in python3.14-cryptography stem from two critical issues: first, the presence of duplicate self-signed intermediates can lead to exponential path-building, which may cause denial of service or excessive resource consumption (CVE-2026-69249). Second, the verifier's acceptance of wildcard DNS names allows for potential escape from permitted subtrees, which could enable unauthorized access to sensitive data (CVE-2026-69248). These vulnerabilities can be exploited by attackers to compromise the integrity and confidentiality of applications relying on this library.
How To Fix
Minimum fixed version
45.0.4-4.el10_2.5
This is the first release that contains the fix.
sudo dnf update python3.14-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider avoiding the use of wildcard DNS names in your configurations until the package is updated. Additionally, review your application's dependency management to ensure that no vulnerable versions are being utilized.
Conclusion
The vulnerabilities in python3.14-cryptography pose significant risks to applications relying on this library. It is crucial to update to the patched version to mitigate these risks. Regular monitoring and proactive management of dependencies are essential for maintaining application security.
See every vulnerability recorded for python3.14-cryptography →
FAQ
The vulnerabilities can lead to denial of service and unauthorized access to sensitive data, potentially compromising application security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, avoid using wildcard DNS names and review your application's dependency management to minimize risk.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be exploited by attackers to compromise application security.
It is recommended to regularly check for vulnerabilities in your dependencies, ideally on a weekly basis, to ensure your applications remain secure.
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-cryptography.
