VulnerabilityAnalyzed

CVE-2026-34073

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

LOW 1.7EPSS 0.15%

Does this matter?

Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

CVSS 4.0: 1.7 LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.15% probability · 5th percentile
CISA KEV: Not listed
Weakness: CWE-295
Affected: cryptography.io/cryptography
Source: security-advisories@github.com

References

https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.