CVE-2026-34073 pyca CVE debrief

Who should care

Defenders responsible for certificate validation and cryptography package management should assess exposure and prioritize remediation. This includes teams managing public key infrastructure, those responsible for updating and patching software dependencies, and security teams overseeing vulnerability management processes.

Why it matters

The cryptography package vulnerability CVE-2026-34073 allows a peer to validate against a wildcard leaf certificate even if the leaf's parent certificate contains an excluded subtree constraint. Defenders should prioritize verifying if their systems use a vulnerable version and upgrade to version 46.0.6 or later.

• Defenders need to verify if their systems use a vulnerable version of the cryptography package.
• Remediation priority is high for systems using vulnerable versions of the cryptography package.
• Defenders should review certificate validation processes to ensure proper DNS name constraint enforcement.

Technical summary

The cryptography package has an incomplete DNS name constraint enforcement on peer names. This issue allows a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate contains an excluded subtree constraint for bar.example.com. The vulnerability is patched in version 46.0.6, and defenders should prioritize verifying if their systems use a vulnerable version and review certificate validation processes to ensure proper DNS name constraint enforcement.

Defensive priority

Defenders should prioritize verifying if their systems use a vulnerable version of the cryptography package and upgrade to version 46.0.6 or later.

Recommended defensive actions

• Verify if your systems use a vulnerable version of the cryptography package.
• Upgrade to version 46.0.6 or later.
• Review certificate validation processes to ensure proper DNS name constraint enforcement.
• Perform an inventory of systems that may be using the vulnerable version of the cryptography package.
• Monitor for potential exploitation attempts.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets.

Evidence notes

The CVE record and source item provide details about the vulnerability and its patch. However, additional information about potential exploitation or affected systems is limited. Defenders should verify if their systems use a vulnerable version and review certificate validation processes. Evidence is based on CVE Program and NVD details, with limited additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.