CVE-2026-69249: Python-Cryptography DoS Vulnerability

CVE-2026-69249 Overview

CVE-2026-69249 is a denial-of-service vulnerability in the python-cryptography package, a widely used library that exposes cryptographic primitives and recipes to Python developers. Versions prior to 49.0.0 contain a flaw in the certificate chain building logic. When the library processes an invalid certificate chain that contains duplicate copies of self-signed certificates, the build_chain_inner function recursively re-evaluates the same candidate certificates. This produces an exponential blowup in processing time. An attacker-controlled certificate chain can force the validator to spend more than five seconds rejecting a single chain, providing amplification suitable for a resource exhaustion attack. Correctness of validation is unaffected, so the flaw impacts availability only.

Critical Impact
Attacker-supplied certificate chains can trigger exponential CPU consumption during path validation, enabling remote denial of service against services that accept untrusted X.509 chains.

Affected Products

pyca/cryptography (python-cryptography) versions prior to 49.0.0
Python applications and services performing X.509 chain validation with the vulnerable library
Downstream distributions and container images that bundle vulnerable versions of cryptography

Discovery Timeline

2026-08-03 - CVE-2026-69249 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69249

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw classified under [CWE-400] Uncontrolled Resource Consumption. The build_chain_inner routine in the Rust-based cryptography-x509-verification crate constructs candidate certificate chains recursively. When an input chain contains duplicate self-signed certificates, each duplicate is treated as a fresh candidate and re-explored. The candidate set is not deduplicated against previously analyzed certificates.

The maximum chain depth bound prevents unbounded recursion and guarantees termination. However, within that depth bound, the number of explored candidate paths grows exponentially with the number of duplicated certificates. Testing showed rejection times exceeding five seconds for crafted inputs, making the flaw usable as an amplification primitive.

Root Cause

The root cause is missing deduplication in the recursive path-construction algorithm. build_chain_inner invokes itself with candidate issuers without tracking which certificates have already been visited on the current search path. Duplicate self-signed certificates therefore multiply the search space rather than being pruned as redundant.

Attack Vector

The attack requires network access to any endpoint that accepts and validates a caller-supplied X.509 certificate chain using python-cryptography. Typical targets include TLS servers performing mutual TLS, code-signing verifiers, S/MIME processors, and any application that calls the library's verification APIs on untrusted input. No authentication or user interaction is required.

rust

     PresentExtensionValidatorCallback,
 };
 use crate::types::{DNSName, DNSPattern, IPAddress};
-use crate::{ValidationError, ValidationErrorKind, ValidationResult, VerificationCertificate};
+use crate::{
+    Budget, ValidationError, ValidationErrorKind, ValidationResult, VerificationCertificate,
+};
 
 // RSA key constraints, as defined in CA/B 6.1.5.
 const WEBPKI_MINIMUM_RSA_MODULUS: usize = 2048;

Source: GitHub Commit 4a12cf4. The patch introduces a Budget type into path construction, bounding the number of signature validations performed during chain building.

Detection Methods for CVE-2026-69249

Indicators of Compromise

Sustained spikes in CPU utilization on processes performing X.509 verification, correlated with inbound TLS handshakes or certificate submissions
Prolonged latency (greater than five seconds) when rejecting client certificates or verifying supplied chains
Repeated inbound connections presenting large certificate chains containing duplicate self-signed certificates

Detection Strategies

Inventory Python environments and container images for installed versions of cryptography below 49.0.0 using SBOM tooling or pip list
Instrument verification code paths to log chain length, duplicate certificate counts, and validation duration
Alert on outlier certificate chains where the count of self-signed certificates exceeds normal baselines

Monitoring Recommendations

Monitor per-request CPU time and wall-clock latency for TLS termination and mTLS validation services
Capture and retain rejected certificate chains for forensic analysis of amplification attempts
Correlate application-layer latency anomalies with source IPs to identify coordinated resource exhaustion attempts

How to Mitigate CVE-2026-69249

Immediate Actions Required

Upgrade python-cryptography to version 49.0.0 or later in all Python runtimes, virtual environments, and container images
Rebuild and redeploy application artifacts that vendor or bundle the vulnerable library
Audit dependency trees for transitive pins to older cryptography releases and update lockfiles accordingly

Patch Information

The issue is fixed in python-cryptography version 49.0.0. The fix adds a signature validation budget during path construction, bounding the recursive work performed by build_chain_inner. See the GitHub Security Advisory GHSA-jwv3-5hgf-82ww, the upstream Pull Request #14960, and the remediation commit for implementation details.

Workarounds

Enforce strict request timeouts and per-connection CPU quotas on services that verify untrusted certificate chains
Reject inbound chains that exceed a conservative maximum certificate count before invoking the vulnerable code path
Rate-limit and throttle sources that repeatedly present malformed or oversized certificate chains

bash

# Upgrade python-cryptography to the fixed release
pip install --upgrade 'cryptography>=49.0.0'

# Verify the installed version
python -c "import cryptography; print(cryptography.__version__)"

# Audit a project's dependency tree for vulnerable pins
pip list --format=columns | grep -i cryptography