Critical Security Flaw in python3.14-cryptography: Exponential Path-Building and Wildcard DNS Escape
Summary
RLSA-2026:64774: Important: python3.14-cryptography security update. Affects python3.14-cryptography versions < 0:45.0.4-4.el9_8.6. Fixed in 0:45.0.4-4.el9_8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3.14-cryptography package is a widely used library in Python that provides cryptographic recipes and primitives to developers. It supports various encryption algorithms, key management, and secure communication protocols. However, recent vulnerabilities have been identified that compromise its security, specifically related to self-signed intermediates and wildcard DNS names, which could lead to significant security risks.
Vulnerability Detail
The vulnerabilities in python3.14-cryptography stem from two main issues: first, the presence of duplicate self-signed intermediates can lead to exponential path-building, which may cause denial of service (CVE-2026-69249). Second, the verifier's acceptance of wildcard DNS names allows for escape from permitted subtrees, potentially exposing sensitive data or enabling unauthorized access (CVE-2026-69248). These vulnerabilities can be exploited by attackers to manipulate cryptographic operations, leading to severe security breaches.
How To Fix
Minimum fixed version
0:45.0.4-4.el9_8.6
This is the first release that contains the fix.
sudo dnf update python3.14-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the available security update as soon as possible.
Conclusion
In summary, the python3.14-cryptography package has critical vulnerabilities that need immediate attention. Users are advised to update to the latest patched version to protect their applications from potential exploits. Regular monitoring and updates are essential for maintaining software security.
See every vulnerability recorded for python3.14-cryptography →
FAQ
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
The vulnerabilities can lead to denial of service, unauthorized access to sensitive data, and manipulation of cryptographic operations, posing significant security risks.
Using the affected version poses security risks. It is highly recommended to update to the patched version to mitigate these vulnerabilities.
The python3.14-cryptography package is maintained by the Rocky Enterprise Software Foundation and Red Hat, who provide security updates and support.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-cryptography.
