DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-69249: CVE-2026-69249: Exponential Backtracking Denial of Service in python-cryptography X.509 Verification Engine

#security #cve #cybersecurity

CVE-2026-69249: Exponential Backtracking Denial of Service in python-cryptography X.509 Verification Engine

Vulnerability ID: CVE-2026-69249
CVSS Score: 8.7
Published: 2026-08-03

An uncontrolled resource consumption vulnerability (CWE-400) exists in the python-cryptography library's Rust-based X.509 verification engine. The flaw allows unauthenticated remote attackers to trigger severe CPU exhaustion and Denial of Service (DoS) by supplying specially crafted certificate chains containing duplicate self-signed certificates, forcing the recursive path builder into an exponential state-search loop.

TL;DR

Unauthenticated remote attackers can cause complete CPU exhaustion and Denial of Service (DoS) on endpoints using python-cryptography by submitting malformed certificate chains containing duplicate self-signed intermediates, triggering an exponential path-building backtracking loop.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network (AV:N)
  • CVSS v4.0 Score: 8.7 (High)
  • Impact: Denial of Service (DoS) via CPU Exhaustion
  • Exploit Status: Proof-of-Concept (PoC) available
  • KEV Status: Not listed on CISA KEV

Affected Systems

  • Python environments utilizing the cryptography package version < 49.0.0
  • Application servers implementing custom X.509 chain building or client certificate verification using PolicyBuilder
  • S/MIME and client-authenticated TLS validation gateways relying on the pyca/cryptography engine
  • cryptography: < 49.0.0 (Fixed in: 49.0.0)

Code Analysis

Commit: 4a12cf4

Fix exponential backtracking in path validation by implementing signature budget and AKI/SKI prioritisation

Exploit Details

  • GitHub Security Advisory: Advisory containing the explanation and reproduction code demonstrating path construction resource consumption.

Mitigation Strategies

  • Upgrade the python-cryptography dependency to version 49.0.0 or higher immediately.
  • Implement a request size and certificate chain length limit at the ingress reverse proxy or API gateway.
  • Enforce execution timeouts on tasks processing untrusted certificate parsing and validation.

Remediation Steps:

  1. Identify all Python execution environments and virtualenvs running python-cryptography.
  2. Run the pip install upgrade command: pip install --upgrade cryptography>=49.0.0.
  3. Validate the installed version using: python3 -c "import cryptography; print(cryptography.__version__)".
  4. Restart any daemonized processes or application servers to reload the patched native library binaries.

References

Read the full report for CVE-2026-69249 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)