Loading story…
A high-severity denial-of-service vulnerability, CVE-2026-69249, was disclosed in the Python cryptography package’s Rust-based X.509 verification engine. The flaw affects versions earlier than 49.0.0 and can be triggered remotely by supplying malformed certificate chains with duplicate self-signed intermediate certificates, causing certificate path building to revisit the same issuers and consume excessive CPU through exponential backtracking. Testing cited in the disclosures showed malicious inputs could take more than five seconds to reject or even time out, although recursion limits prevented infinite loops and the bug did not alter certificate validation correctness or system integrity.
The issue was fixed in cryptography version 49.0.0 through commit 4a12cf49675a184e47f912b00b04f3a629283582, which adds a global signature verification budget of 128 checks during path construction and improves issuer selection by prioritizing likely parents using AKI/SKI matching, with trusted-store candidates preferred over untrusted intermediates. Project maintainers said the changes cut malicious-chain validation from seconds to milliseconds in benchmarks, and the merged patch also added tests for looping and overflow scenarios to ensure recursive chain-building work remains bounded.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-69249 was published, describing a high-severity uncontrolled resource consumption vulnerability in python-cryptography's X.509 verification engine affecting versions before 49.0.0.
PyCA merged commit 4a12cf49675a184e47f912b00b04f3a629283582 into main, adding a global signature verification budget of 128 checks and improving issuer selection in the Rust cryptography-x509-verification component.
PyCA opened pull request #14960 to add a signature validation budget during X.509 path construction and prioritize issuer candidates using AKI/SKI matching to reduce excessive validation work.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A denial-of-service vulnerability tracked as **CVE-2026-32281** was disclosed in Go’s `crypto/x509` package after maintainers found certificate policy validation can degrade to quadratic work when processing chains with very large `PolicyMappings`. The flaw affects verification of otherwise trusted certificate chains anchored in `VerifyOptions.Roots` or the system certificate pool, allowing excessive CPU and resource consumption during chain validation. Exploitation requires a specially crafted chain tied to a compromised trusted root, but Red Hat still rated the issue **Moderate** while noting higher severity scores were assigned by other scoring authorities. Red Hat said fixes were issued across a wide range of products, including multiple **Red Hat Enterprise Linux** versions and update streams, **Satellite**, **Cryostat**, **OpenStack**, **Ansible Automation Platform**, and **RHEM/flightctl**, with additional affected products added as availability changed after initial triage. Red Hat also stated there is **no acceptable mitigation** short of applying vendor updates, making patch deployment the primary response for organizations running Go-based services or platforms that rely on `crypto/x509` certificate chain validation.
Sep 1, 2026
A denial-of-service vulnerability tracked as **CVE-2026-32280** was disclosed in Go's standard library, affecting `crypto/x509` and `crypto/tls` during X.509 certificate verification. The flaw stems from excessive certificate chain-building work in `Verify` when an attacker supplies a large number of candidate intermediate certificates, causing uncontrolled CPU and resource consumption and potentially making applications unavailable. The issue affects systems that use Go to process untrusted TLS certificates or X.509 chains, particularly network-facing services that accept attacker-controlled certificate inputs. Red Hat rated the vulnerability **Important** with a **CVSS v3.1 score of 7.5**, mapped it to **CWE-770**, and published fixes across multiple products, including **Red Hat Enterprise Linux 10 golang** and several **Ansible Automation Platform**, **Cryostat**, and **HawtIO** components.
Aug 20, 2026
An **Important** vulnerability tracked as `CVE-2026-33810` affects Go's `crypto/x509` package and can allow a certificate validation bypass during trusted certificate chain verification. The flaw stems from excluded DNS constraints not being correctly applied to wildcard DNS Subject Alternative Names when the SAN's case differs from the constraint, creating a path for a malicious certificate to be accepted when it should be rejected. Red Hat assigned the issue a **CVSS v3 score of 8.8** and warned that affected products could accept malicious certificates from otherwise trusted chains, weakening the certificate trust model. Red Hat said multiple affected products and components have been fixed through security errata, while the CVE record formally tracks the issue as `CVE-2026-33810`.
Aug 20, 2026