{"id":"CVE-2026-69249","aliases":["GHSA-jwv3-5hgf-82ww","PYSEC-2026-3553"],"url":"https://o3.security/vulnerability/CVE-2026-69249","summary":"python-cryptography: Duplicate self-signed intermediates can cause exponential path-building","details":"python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.","published":"2026-08-03T21:26:45.826Z","modified":"2026-09-12T03:30:58.379201167Z","cvss":null,"epss":{"score":0.00252,"percentile":0.16895,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"cryptography","fixedVersion":"49.0.0"}],"fix":{"url":"https://github.com/pyca/cryptography/commit/3763aa79b","label":"pyca/cryptography@3763aa7"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69249.json"},{"type":"ADVISORY","url":"https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww"},{"type":"ADVISORY","url":"https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69249"},{"type":"FIX","url":"https://github.com/pyca/cryptography/commit/3763aa79b"},{"type":"FIX","url":"https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582"},{"type":"FIX","url":"https://github.com/pyca/cryptography/pull/14960"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-12T03:30:58.379201167Z"}}