cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Tue, 31 Mar 2026 03:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6. | |
| Title | cryptography has incomplete DNS name constraint enforcement on peer names | |
| Weaknesses | CWE-295 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-03-31T02:04:36.275Z
Reserved: 2026-03-25T16:21:40.868Z
Link: CVE-2026-34073
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-31T03:15:59.123
Modified: 2026-03-31T03:15:59.123
Link: CVE-2026-34073
Redhat
No data.
OpenCVE Enrichment
No data.