CVE-2026-69248

Cryptography (Python) prior to 49.0.0 may accept a leaf certificate with a wildcard SAN (*.example.com) when a constrained sub-CA permits foo.example.com, due to DNSConstraint::matches treating a wildcard as matching the permitted constraint. This can allow escaping to sibling names (e.g., bar.ex...

CVE-2026-69248 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com,...