Critical Security Flaw in python3.14-cryptography: Exponential Path-Building and Wildcard DNS Escape
Summary
RLSA-2026:64795: Important: python3.14-cryptography security update. Affects python3.14-cryptography versions < 0:45.0.4-4.el10_2.5. Fixed in 0:45.0.4-4.el10_2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3.14-cryptography package is a widely used library in Python that provides cryptographic recipes and primitives to developers. It is designed to be secure and easy to use, supporting various encryption algorithms and protocols. However, recent vulnerabilities have been identified that could potentially compromise the security of applications relying on this library.
Vulnerability Detail
The vulnerabilities identified in python3.14-cryptography include CVE-2026-69249, which allows for exponential path-building due to duplicate self-signed intermediates, and CVE-2026-69248, where the verifier accepts wildcard DNS names, enabling escape from permittedSubtrees. These issues can lead to severe security risks, including unauthorized access and data breaches, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
0:45.0.4-4.el10_2.5
This is the first release that contains the fix.
sudo dnf update python3.14-cryptographyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for these vulnerabilities. The best course of action is to apply the available patch as soon as possible.
Conclusion
In summary, the python3.14-cryptography package has critical vulnerabilities that need immediate attention. Users are encouraged to update to the patched version to mitigate potential security risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python3.14-cryptography →
FAQ
The CVSS score for the vulnerabilities in python3.14-cryptography is 7.5, indicating a high severity level.
The vulnerabilities could lead to unauthorized access, data breaches, and exploitation of applications that rely on the affected library.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
While there are no specific workarounds, it is advisable to limit the use of the affected library until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.14-cryptography.
