Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M
CVE-2026-34073cryptography has incomplete DNS name constraint enforcement on peer names
Low 1.7
In plain English
A low-severity improper certificate validation in cryptography from pyca. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | py3-cryptography | 46.0.7-r0 | ALPINE-CVE-2026-34073 |
| Alpine:v3.24 | py3-cryptography | 46.0.7-r0 | ALPINE-CVE-2026-34073 |
| Debian:12 | python-cryptography | no fix listed | DEBIAN-CVE-2026-34073 |
| Debian:13 | python-cryptography | no fix listed | DEBIAN-CVE-2026-34073 |
| Debian:14 | python-cryptography | 46.0.6-1 | DEBIAN-CVE-2026-34073 |
| PyPI | cryptography | 46.0.6 | PYSEC-2026-35 |
| PyPI | cryptography | 46.0.6 | GHSA-m959-cc7f-wv43 |
| Ubuntu:22.04:LTS | python-cryptography | no fix listed | UBUNTU-CVE-2026-34073 |
| Ubuntu:24.04:LTS | python-cryptography | no fix listed | UBUNTU-CVE-2026-34073 |
| Ubuntu:25.10 | python-cryptography | no fix listed | UBUNTU-CVE-2026-34073 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pyca | cryptography | < 46.0.6 |
Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U