HIGH
pyca
CVE published 2026-08-03
CVE-2026-69249
The python-cryptography package, versions 42.0.0 through 48.0.0, is vulnerable to a resource exhaustion denial of service attack due to recursive processing of invalid certificate chains with duplicate self-signed certificates. This issue arises from the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates, leading to potential resource exhaustion. The [truncated]