https://vulnerability.circl.lu/sightings/feed 2026-08-04T21:40:16.122469+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/18494c72-ad9f-43c8-89b5-33b850f08b1e/export 2026-08-04T21:40:16.152027+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "18494c72-ad9f-43c8-89b5-33b850f08b1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69248", "type": "seen", "source": "https://gist.github.com/alon710/ab6ab460d039209b756930fd867ab75f", "content": "# CVE-2026-69248: CVE-2026-69248: Name Constraints Bypass via Wildcard SANs in Python cryptography\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69248\n\n## Summary\nAn improper certificate validation vulnerability (CWE-295) in the Rust-based X.509 verification engine of python-cryptography allows wildcard Subject Alternative Names (SANs) to bypass permitted Name Constraints. This enables an attacker to construct certificates that escape the restricted scope of a subordinate Certificate Authority (CA) and successfully authenticate against vulnerable client installations. The vulnerability is tracked as CVE-2026-69248 and GHSA-m2h6-j472-rp4c, with a CVSS v4.0 base score of 6.9.\n\n## TL;DR\nA flaw in python-cryptography's Rust-based X.509 verifier allows a wildcard SAN (e.g., `*.example.com`) to satisfy a restricted permitted Name Constraint (e.g., `foo.example.com`), enabling subordinate CA scope escape.\n\n## Technical Details\n\n- **CWE ID**: CWE-295\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.9 (Medium)\n- **EPSS Score**: Not yet indexed\n- **Impact**: High (Complete Bypass of Certificate-Based Trust Boundaries)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- python-cryptography (cryptography-x509-verification crate)\n- **cryptography**: < 49.0.0 (Fixed in: `49.0.0`)\n\n## Mitigation\n\n- Upgrade python-cryptography to version 49.0.0 or higher.\n- Audit active certificates in the PKI to identify wildcard SANs issued by restricted sub-CAs.\n- Implement validation-layer checks in Python code to enforce minimum library versions.\n\n**Remediation Steps:**\n1. Identify all virtual environments and containers running python-cryptography.\n2. Execute the upgrade command: pip install --upgrade \"cryptography>=49.0.0\".\n3. Re-deploy applications and verify that the active library version is at least 49.0.0.\n4. Validate certificate issuance policies to ensure sub-CAs cannot sign wildcard certificates that violate constraints.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69248) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T00:00:43.607882Z"} 2026-08-04T00:00:43.607882+00:00 https://vulnerability.circl.lu/sighting/7ffdd3c4-779e-47db-9a29-7beb157da053/export 2026-08-04T21:40:16.155901+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "7ffdd3c4-779e-47db-9a29-7beb157da053", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69248", "type": "published-proof-of-concept", "source": "https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c", "content": "", "creation_timestamp": "2026-08-03T22:35:04.478372Z"} 2026-08-03T22:35:04.478372+00:00 https://vulnerability.circl.lu/sighting/70f522ff-9958-4513-9d5a-6b0208db1c51/export 2026-08-04T21:40:16.158399+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "70f522ff-9958-4513-9d5a-6b0208db1c51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69248", "type": "seen", "source": "https://gist.github.com/alon710/ab6ab460d039209b756930fd867ab75f", "content": "# CVE-2026-69248: CVE-2026-69248: Name Constraints Bypass via Wildcard SANs in Python cryptography\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69248\n\n## Summary\nAn improper certificate validation vulnerability (CWE-295) in the Rust-based X.509 verification engine of python-cryptography allows wildcard Subject Alternative Names (SANs) to bypass permitted Name Constraints. This enables an attacker to construct certificates that escape the restricted scope of a subordinate Certificate Authority (CA) and successfully authenticate against vulnerable client installations. The vulnerability is tracked as CVE-2026-69248 and GHSA-m2h6-j472-rp4c, with a CVSS v4.0 base score of 6.9.\n\n## TL;DR\nA flaw in python-cryptography's Rust-based X.509 verifier allows a wildcard SAN (e.g., `*.example.com`) to satisfy a restricted permitted Name Constraint (e.g., `foo.example.com`), enabling subordinate CA scope escape.\n\n## Technical Details\n\n- **CWE ID**: CWE-295\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.9 (Medium)\n- **EPSS Score**: Not yet indexed\n- **Impact**: High (Complete Bypass of Certificate-Based Trust Boundaries)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- python-cryptography (cryptography-x509-verification crate)\n- **cryptography**: < 49.0.0 (Fixed in: `49.0.0`)\n\n## Mitigation\n\n- Upgrade python-cryptography to version 49.0.0 or higher.\n- Audit active certificates in the PKI to identify wildcard SANs issued by restricted sub-CAs.\n- Implement validation-layer checks in Python code to enforce minimum library versions.\n\n**Remediation Steps:**\n1. Identify all virtual environments and containers running python-cryptography.\n2. Execute the upgrade command: pip install --upgrade \"cryptography>=49.0.0\".\n3. Re-deploy applications and verify that the active library version is at least 49.0.0.\n4. Validate certificate issuance policies to ensure sub-CAs cannot sign wildcard certificates that violate constraints.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69248) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T22:31:31.236955Z"} 2026-08-03T22:31:31.236955+00:00 https://vulnerability.circl.lu/sighting/40e86982-6d7f-4c83-80b4-eb8f5b27efdd/export 2026-08-04T21:40:16.158549+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "40e86982-6d7f-4c83-80b4-eb8f5b27efdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69248", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ecmrxfdhpjgt4", "content": "CVE-2026-69248 - python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees\nCVE ID : CVE-2026-69248\n \n Published : Aug. 3, 2026, 9:21 p.m. | 37\u00a0minutes ago\n \n Description : cryptography is a package designed to expose cryptographic primitive...", "creation_timestamp": "2026-08-03T22:08:16.733765Z"} 2026-08-03T22:08:16.733765+00:00