https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 04 Aug 2026 06:19:13 +0000 https://vulnerability.circl.lu/sighting/4bbad302-19c6-45a2-97e6-f862ee757388/export {"uuid": "4bbad302-19c6-45a2-97e6-f862ee757388", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69249", "type": "seen", "source": "https://gist.github.com/alon710/5ac467a3d50f6bfb29b3f3cc3d2c5925", "content": "# CVE-2026-69249: CVE-2026-69249: Exponential Backtracking Denial of Service in python-cryptography X.509 Verification Engine\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69249\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-400) exists in the python-cryptography library's Rust-based X.509 verification engine. The flaw allows unauthenticated remote attackers to trigger severe CPU exhaustion and Denial of Service (DoS) by supplying specially crafted certificate chains containing duplicate self-signed certificates, forcing the recursive path builder into an exponential state-search loop.\n\n## TL;DR\nUnauthenticated remote attackers can cause complete CPU exhaustion and Denial of Service (DoS) on endpoints using python-cryptography by submitting malformed certificate chains containing duplicate self-signed intermediates, triggering an exponential path-building backtracking loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7 (High)\n- **Impact**: Denial of Service (DoS) via CPU Exhaustion\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed on CISA KEV\n\n## Affected Systems\n\n- Python environments utilizing the cryptography package version < 49.0.0\n- Application servers implementing custom X.509 chain building or client certificate verification using PolicyBuilder\n- S/MIME and client-authenticated TLS validation gateways relying on the pyca/cryptography engine\n- **cryptography**: < 49.0.0 (Fixed in: `49.0.0`)\n\n## Mitigation\n\n- Upgrade the python-cryptography dependency to version 49.0.0 or higher immediately.\n- Implement a request size and certificate chain length limit at the ingress reverse proxy or API gateway.\n- Enforce execution timeouts on tasks processing untrusted certificate parsing and validation.\n\n**Remediation Steps:**\n1. Identify all Python execution environments and virtualenvs running python-cryptography.\n2. Run the pip install upgrade command: `pip install --upgrade cryptography>=49.0.0`.\n3. Validate the installed version using: `python3 -c \"import cryptography; print(cryptography.__version__)\"`.\n4. Restart any daemonized processes or application servers to reload the patched native library binaries.\n\n## References\n\n- [GHSA-jwv3-5hgf-82ww: Path validation algorithmic complexity vulnerability](https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww)\n- [Fix Commit 4a12cf49675a184e47f912b00b04f3a629283582](https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582)\n- [Authoritative CVE-2026-69249 Record](https://www.cve.org/CVERecord?id=CVE-2026-69249)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69249) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T00:00:43.516266Z"} {"uuid": "4bbad302-19c6-45a2-97e6-f862ee757388", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69249", "type": "seen", "source": "https://gist.github.com/alon710/5ac467a3d50f6bfb29b3f3cc3d2c5925", "content": "# CVE-2026-69249: CVE-2026-69249: Exponential Backtracking Denial of Service in python-cryptography X.509 Verification Engine\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69249\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-400) exists in the python-cryptography library's Rust-based X.509 verification engine. The flaw allows unauthenticated remote attackers to trigger severe CPU exhaustion and Denial of Service (DoS) by supplying specially crafted certificate chains containing duplicate self-signed certificates, forcing the recursive path builder into an exponential state-search loop.\n\n## TL;DR\nUnauthenticated remote attackers can cause complete CPU exhaustion and Denial of Service (DoS) on endpoints using python-cryptography by submitting malformed certificate chains containing duplicate self-signed intermediates, triggering an exponential path-building backtracking loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7 (High)\n- **Impact**: Denial of Service (DoS) via CPU Exhaustion\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed on CISA KEV\n\n## Affected Systems\n\n- Python environments utilizing the cryptography package version < 49.0.0\n- Application servers implementing custom X.509 chain building or client certificate verification using PolicyBuilder\n- S/MIME and client-authenticated TLS validation gateways relying on the pyca/cryptography engine\n- **cryptography**: < 49.0.0 (Fixed in: `49.0.0`)\n\n## Mitigation\n\n- Upgrade the python-cryptography dependency to version 49.0.0 or higher immediately.\n- Implement a request size and certificate chain length limit at the ingress reverse proxy or API gateway.\n- Enforce execution timeouts on tasks processing untrusted certificate parsing and validation.\n\n**Remediation Steps:**\n1. Identify all Python execution environments and virtualenvs running python-cryptography.\n2. Run the pip install upgrade command: `pip install --upgrade cryptography>=49.0.0`.\n3. Validate the installed version using: `python3 -c \"import cryptography; print(cryptography.__version__)\"`.\n4. Restart any daemonized processes or application servers to reload the patched native library binaries.\n\n## References\n\n- [GHSA-jwv3-5hgf-82ww: Path validation algorithmic complexity vulnerability](https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww)\n- [Fix Commit 4a12cf49675a184e47f912b00b04f3a629283582](https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582)\n- [Authoritative CVE-2026-69249 Record](https://www.cve.org/CVERecord?id=CVE-2026-69249)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69249) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T00:00:43.516266Z"} https://vulnerability.circl.lu/sighting/4bbad302-19c6-45a2-97e6-f862ee757388/export Tue, 04 Aug 2026 00:00:43 +0000 https://vulnerability.circl.lu/sighting/9f60dafc-2faa-44cf-ada7-cdac891dc16d/export {"uuid": "9f60dafc-2faa-44cf-ada7-cdac891dc16d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69249", "type": "seen", "source": "https://gist.github.com/alon710/5ac467a3d50f6bfb29b3f3cc3d2c5925", "content": "# CVE-2026-69249: CVE-2026-69249: Exponential Backtracking Denial of Service in python-cryptography X.509 Verification Engine\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69249\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-400) exists in the python-cryptography library's Rust-based X.509 verification engine. The flaw allows unauthenticated remote attackers to trigger severe CPU exhaustion and Denial of Service (DoS) by supplying specially crafted certificate chains containing duplicate self-signed certificates, forcing the recursive path builder into an exponential state-search loop.\n\n## TL;DR\nUnauthenticated remote attackers can cause complete CPU exhaustion and Denial of Service (DoS) on endpoints using python-cryptography by submitting malformed certificate chains containing duplicate self-signed intermediates, triggering an exponential path-building backtracking loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7 (High)\n- **Impact**: Denial of Service (DoS) via CPU Exhaustion\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed on CISA KEV\n\n## Affected Systems\n\n- Python environments utilizing the cryptography package version < 49.0.0\n- Application servers implementing custom X.509 chain building or client certificate verification using PolicyBuilder\n- S/MIME and client-authenticated TLS validation gateways relying on the pyca/cryptography engine\n- **cryptography**: < 49.0.0 (Fixed in: `49.0.0`)\n\n## Mitigation\n\n- Upgrade the python-cryptography dependency to version 49.0.0 or higher immediately.\n- Implement a request size and certificate chain length limit at the ingress reverse proxy or API gateway.\n- Enforce execution timeouts on tasks processing untrusted certificate parsing and validation.\n\n**Remediation Steps:**\n1. Identify all Python execution environments and virtualenvs running python-cryptography.\n2. Run the pip install upgrade command: `pip install --upgrade cryptography>=49.0.0`.\n3. Validate the installed version using: `python3 -c \"import cryptography; print(cryptography.__version__)\"`.\n4. Restart any daemonized processes or application servers to reload the patched native library binaries.\n\n## References\n\n- [GHSA-jwv3-5hgf-82ww: Path validation algorithmic complexity vulnerability](https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww)\n- [Fix Commit 4a12cf49675a184e47f912b00b04f3a629283582](https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582)\n- [Authoritative CVE-2026-69249 Record](https://www.cve.org/CVERecord?id=CVE-2026-69249)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69249) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T23:31:38.811141Z"} {"uuid": "9f60dafc-2faa-44cf-ada7-cdac891dc16d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69249", "type": "seen", "source": "https://gist.github.com/alon710/5ac467a3d50f6bfb29b3f3cc3d2c5925", "content": "# CVE-2026-69249: CVE-2026-69249: Exponential Backtracking Denial of Service in python-cryptography X.509 Verification Engine\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69249\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-400) exists in the python-cryptography library's Rust-based X.509 verification engine. The flaw allows unauthenticated remote attackers to trigger severe CPU exhaustion and Denial of Service (DoS) by supplying specially crafted certificate chains containing duplicate self-signed certificates, forcing the recursive path builder into an exponential state-search loop.\n\n## TL;DR\nUnauthenticated remote attackers can cause complete CPU exhaustion and Denial of Service (DoS) on endpoints using python-cryptography by submitting malformed certificate chains containing duplicate self-signed intermediates, triggering an exponential path-building backtracking loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7 (High)\n- **Impact**: Denial of Service (DoS) via CPU Exhaustion\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed on CISA KEV\n\n## Affected Systems\n\n- Python environments utilizing the cryptography package version < 49.0.0\n- Application servers implementing custom X.509 chain building or client certificate verification using PolicyBuilder\n- S/MIME and client-authenticated TLS validation gateways relying on the pyca/cryptography engine\n- **cryptography**: < 49.0.0 (Fixed in: `49.0.0`)\n\n## Mitigation\n\n- Upgrade the python-cryptography dependency to version 49.0.0 or higher immediately.\n- Implement a request size and certificate chain length limit at the ingress reverse proxy or API gateway.\n- Enforce execution timeouts on tasks processing untrusted certificate parsing and validation.\n\n**Remediation Steps:**\n1. Identify all Python execution environments and virtualenvs running python-cryptography.\n2. Run the pip install upgrade command: `pip install --upgrade cryptography>=49.0.0`.\n3. Validate the installed version using: `python3 -c \"import cryptography; print(cryptography.__version__)\"`.\n4. Restart any daemonized processes or application servers to reload the patched native library binaries.\n\n## References\n\n- [GHSA-jwv3-5hgf-82ww: Path validation algorithmic complexity vulnerability](https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww)\n- [Fix Commit 4a12cf49675a184e47f912b00b04f3a629283582](https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582)\n- [Authoritative CVE-2026-69249 Record](https://www.cve.org/CVERecord?id=CVE-2026-69249)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69249) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T23:31:38.811141Z"} https://vulnerability.circl.lu/sighting/9f60dafc-2faa-44cf-ada7-cdac891dc16d/export Mon, 03 Aug 2026 23:31:38 +0000 https://vulnerability.circl.lu/sighting/c147f25e-993c-4a08-aeeb-976b3084243b/export {"uuid": "c147f25e-993c-4a08-aeeb-976b3084243b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69249", "type": "published-proof-of-concept", "source": "https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww", "content": "", "creation_timestamp": "2026-08-03T22:35:06.671267Z"} {"uuid": "c147f25e-993c-4a08-aeeb-976b3084243b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69249", "type": "published-proof-of-concept", "source": "https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww", "content": "", "creation_timestamp": "2026-08-03T22:35:06.671267Z"} https://vulnerability.circl.lu/sighting/c147f25e-993c-4a08-aeeb-976b3084243b/export Mon, 03 Aug 2026 22:35:06 +0000 https://vulnerability.circl.lu/sighting/750c8fa4-4a62-4d3e-8eb6-e03d783eb475/export {"uuid": "750c8fa4-4a62-4d3e-8eb6-e03d783eb475", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69249", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/g2utxha3ngw7m", "content": "CVE-2026-69249 - python-cryptography: Duplicate self-signed intermediates can cause exponential path-building\nCVE ID : CVE-2026-69249\n \n Published : Aug. 3, 2026, 9:26 p.m. | 32\u00a0minutes ago\n \n Description : python-cryptography is a package designed to expose cryptographic prim...", "creation_timestamp": "2026-08-03T22:20:16.911549Z"} {"uuid": "750c8fa4-4a62-4d3e-8eb6-e03d783eb475", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69249", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/g2utxha3ngw7m", "content": "CVE-2026-69249 - python-cryptography: Duplicate self-signed intermediates can cause exponential path-building\nCVE ID : CVE-2026-69249\n \n Published : Aug. 3, 2026, 9:26 p.m. | 32\u00a0minutes ago\n \n Description : python-cryptography is a package designed to expose cryptographic prim...", "creation_timestamp": "2026-08-03T22:20:16.911549Z"} https://vulnerability.circl.lu/sighting/750c8fa4-4a62-4d3e-8eb6-e03d783eb475/export Mon, 03 Aug 2026 22:20:16 +0000