crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

python3.14-cryptography security update

An update is available for python3.14-cryptography. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented...

MiracleLinux 9 : python3.14-cryptography-45.0.4-4.el9_8.6 (AXSA:2026-1788:01)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1788:01 advisory. python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVE-2026-69249 python-cryptography...

Important: Red Hat Security Advisory: python3.14-cryptography security update

An update for python3.14-cryptography is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

A flaw was found in python-cryptography. When processing invalid certificate chains that include duplicate self-signed certificates, the system recursively invokes the same certificate, leading to an exponential increase in processing time. A remote attacker could exploit this by providing a...

SUSE-SU-2026:23196-1 Security update for python-cryptography

This update for python-cryptography fixes the following issues: - CVE-2026-69248: verifier accepts wildcard DNS names allowing escape from permittedSubtrees bsc1273549. - CVE-2026-69249: duplicate self-signed intermediates can cause exponential path-building bsc1273516...

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

...

PYSEC-2026-3553 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the buildchaininner function. An attacker can cause excessive resource consumption by submitting a certificate chain containing duplicate self-signed intermediates, which lead...

GHSA-JWV3-5HGF-82WW python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents...

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents...

CVE-2026-69249

CVE-2026-69249 affects python-cryptography prior to 49.0.0, where resolving invalid certificate chains with duplicate self-signed intermediates can explode in recursion, causing resource exhaustion DoS. The core issue is in the recursive build_chain_inner not de-duplicating previously analyzed ca...

EUVD-2026-52450

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an...

CVE-2026-69249 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same...

CVE-2026-69249 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same...

Allocation of Resources Without Limits or Throttling

Overview brace-expansion is a Brace expansion as known from sh/bash Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the expand, expand, combine, and expandSequence functions, which bound the accumulator where results are combined but not...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

JLSEC-2026-699 X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier...

X.509 trust-chain bypass path-depth exhaustion in the OpenSSL compatibility certificate verifier wolfSSLX509verifycert. This affects only builds with --enable-opensslextra whose application calls X509verifycert with caller-supplied untrusted intermediates; for those users it is critical, otherwis...

JLSEC-2026-697 X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier...

X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier wolfSSLX509verifycert. This affects only builds with --enable-opensslextra OPENSSLEXTRA and whose application validates certificates by calling X509verifycert with caller-supplied untrusted intermediate certificates; for...

JLSEC-2026-717

URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL woul...