RHSA-2026:64774HighCVSS 7.5

Red Hat Security Advisory: python3.14-cryptography security update

Published
September 8, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (2)

CVE-2026-69248 →CVE-2026-69249 →

📋 Description

CVE-2026-69248 — python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees CVE-2026-69249 — python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

🎯 Affected products14

  • Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-0:45.0.4-4.el9_8.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-0:45.0.4-4.el9_8.6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-0:45.0.4-4.el9_8.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-0:45.0.4-4.el9_8.6.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-0:45.0.4-4.el9_8.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-debuginfo-0:45.0.4-4.el9_8.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-debuginfo-0:45.0.4-4.el9_8.6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-debuginfo-0:45.0.4-4.el9_8.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-debuginfo-0:45.0.4-4.el9_8.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-debugsource-0:45.0.4-4.el9_8.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-debugsource-0:45.0.4-4.el9_8.6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-debugsource-0:45.0.4-4.el9_8.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • python3.14-cryptography-debugsource-0:45.0.4-4.el9_8.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: The Rust PolicyBuilder verifier was introduced in cryptography 42.0.0 and this issue was fixed in 49.0.0. Workaround: The Rust PolicyBuilder verifier was introduced in cryptography 42.0.0 and this issue was fixed in 49.0.0 (signature-check budget of 128).

🔗 References (5)