一、漏洞信息
漏洞编号：CVE-2026-69249
漏洞归属组件：cryptography
漏洞归属分支：默认分支
漏洞归属的版本：48.0.0
漏洞修复版本: 49.0.0
CVSS分值：
BaseScore： N/A None
Vector： N/A
漏洞简述：
python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.
漏洞公开时间：2026-08-03 22:16:52
漏洞创建时间：2026-08-05 03:02:56
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-69249
一、漏洞信息
漏洞编号：CVE-2026-69249
漏洞归属组件：cryptography
漏洞归属分支：默认分支
漏洞归属的版本：48.0.0
漏洞修复版本: 49.0.0
CVSS分值：
BaseScore： N/A None
Vector： N/A
漏洞简述：
python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.
漏洞公开时间：2026-08-03 22:16:52
漏洞创建时间：2026-08-05 03:02:56
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-69249