python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
CVE-2026-69249
Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. This work was completed by Trail of Bits as part of the Patch The Planet project in collaboration with OpenAI. The finding was identified primarily by the Codex coding agent, and manually reviewed before submission. Details The core issue arises in the recursive nature of buildchaininner, which does not de-duplicate against previously analyzed candidates. python fn buildchaininner( &self, workingcert: &VerificationCertificate , currentdepth: u8, workingcertextensions: &Extensions , namechain: NameChain , budget: &mut Budget, ) -> ValidationResult , B> { if let Some(nc) = workingcertextensions.getextension(&NAMECONSTRAINTSOID) {…
Assessment
- CVSS
- 8.7 (v4.0)
- Severity
- High
- EPSS
- 0.26% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 3 August 2026
- Last updated
- 23 October 2026
- Affected
- pyca · cryptography · cryptography
- Weakness
- CWE-400
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
At the source
References
- https://github.com/pyca/cryptography/commit/3763aa79b
- https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582
- https://github.com/pyca/cryptography/pull/14960
- https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww
- https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2026-69249
- https://github.com/advisories/GHSA-jwv3-5hgf-82ww
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-69249