Denial of Service Vulnerability in Python-Cryptography Package by Pyca

CVE-2026-69249

What is CVE-2026-69249?

The python-cryptography package prior to version 49.0.0 contains a vulnerability that can cause resource exhaustion through the processing of malicious certificate chains. When resolving invalid chains that include duplicate self-signed certificates, it can lead to excessive processing time due to recursive calls without de-duplication. This vulnerability allows an attacker to intentionally create a situation where the certificate validation delays response times significantly, effectively leading to denial of service. The recursion limit does help, but under certain conditions, the delay can exceed acceptable thresholds. The issue has been resolved in version 49.0.0.

References