Executive brief
The 'cryptography' library, a widely used Python package for secure communication, failed to properly enforce certain security restrictions on domain names during certificate validation. This could allow a malicious actor to use a certificate for a domain that should have been restricted by its parent certificate authority. While this could lead to unauthorized identity validation, it requires a specific and uncommon certificate setup to exploit.
Technical details
In versions of pyca/cryptography prior to 46.0.6, DNS name constraints (RFC 5280) were only validated against Subject Alternative Names (SANs) within child certificates and not against the 'peer name' presented during validation. This logic gap allowed a peer name (e.g., bar.example.com) to successfully validate against a wildcard leaf certificate (e.g., *.example.com) even if a parent certificate explicitly excluded that specific subdomain via name constraints. The vulnerability stems from an implementation gap between RFC 5280 and RFC 9525. Attackers can bypass intended name restrictions in specific X.509 topologies. The issue is addressed in version 46.0.6 by applying name constraints to peer names as if they were SANs.
Affected products
- pyca cryptography < 46.0.6
Timeline
- 2026-03-25: disclosed
- 2026-03-27: advisory: GitHub Advisory published
- 2026-03-25: patched: Version 46.0.6 released