CVE-2026-69249

Description

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.

CVSS Metrics

• v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Trends

Current EPSS score: 0.25%• Percentile: 17%

Techniques & Countermeasures

• CWE-400•Uncontrolled Resource Consumption

  The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

• chainguard•airflow-2

  all

• chainguard•airflow-core-2

  all

• chainguard•apache-beam-python-3.11-sdk

  < 2.75.0-r2

• chainguard•apache-beam-python-3.12-sdk

  < 2.75.0-r1

• chainguard•apache-beam-python-3.13-sdk

  < 2.75.0-r2

• chainguard•authentik-2025.12

  all

• chainguard•datadog-agent-7.75-core-integrations

  all

• chainguard•datadog-agent-fips-7.75-core-integrations

  all

• chainguard•dbt-snowflake

  all

• chainguard•kserve-storage-controller

  all

• chainguard•mlflow

  < 3.16.0-r0

• chainguard•openstack-glance-2025.1

  < 30.2.0_git20260616-r8

• chainguard•openstack-glance-2025.2

  < 31.1.0_git20260708-r2

• chainguard•openstack-glance-2026.1

  < 32.0.0_git20260805-r0

• chainguard•openstack-nova-2025.1

  < 31.3.0_git20260717-r3

• chainguard•openstack-nova-2025.2

  < 32.2.0_git20260715-r2

• chainguard•openstack-nova-2026.1

  < 33.0.1_git20260727-r1

• chainguard•superset-6.0

  all

• chainguard•vllm-openai-cuda-12.9

  all | < 0.29.0-r3

• chainguard•vllm-openai-cuda-13.0

  all

• wolfi•datadog-agent-7.75-core-integrations

  all

• wolfi•kserve-storage-controller

  all

• wolfi•mlflow

  < 3.16.0-r0

• wolfi•superset-6.0

  all

• debian•python-cryptography

  all | all | all | all | < 49.0.0-1

• ubuntu•python-cryptography

  all | all | all | all | < 46.0.5-1ubuntu2.2

• pyca•cryptography

  < 49.0.0 | ≥ 42.0.0, < 49.0.0

• PyPI•cryptography

  < 49.0.0 | ≥ 42.0.0, < 49.0.0

References (14)

• https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww
• https://github.com/pyca/cryptography/pull/14960
• https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582
• https://github.com/pyca/cryptography
• https://pypi.org/project/cryptography
• https://github.com/advisories/GHSA-jwv3-5hgf-82ww
• https://nvd.nist.gov/vuln/detail/CVE-2026-69249
• https://ubuntu.com/security/CVE-2026-69249
• https://www.cve.org/CVERecord?id=CVE-2026-69249
• https://security-tracker.debian.org/tracker/CVE-2026-69249
• https://github.com/pyca/cryptography/commit/3763aa79b
• https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69249.json
• https://ubuntu.com/security/notices/USN-8776-1