ZeroDay Findings
Sign inSign up

Findings

CVE-2026-34073

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

Published Mar 31, 2026 · updated Oct 14, 2026 · cryptography.io cryptography

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 31, 2026 · NIST NVD

    Detected

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.co

  2. Oct 14, 2026 · NIST NVD

    Updated

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.co

Affected

  • cpe cryptography.io/cryptographyversion unspecified

Sources

  • CVE.orgCVE-2026-34073

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-34073

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDCVE-2026-34073

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently

    nvd.nist.gov

References