一、漏洞信息
漏洞编号：CVE-2026-69248
漏洞归属组件：cryptography
漏洞归属分支：默认分支
漏洞归属的版本：48.0.0
漏洞修复版本: 49.0.0
CVSS分值：
BaseScore： N/A None
Vector： N/A
漏洞简述：
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
漏洞公开时间：2026-08-03 22:16:52
漏洞创建时间：2026-08-05 03:02:57
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-69248
一、漏洞信息
漏洞编号：CVE-2026-69248
漏洞归属组件：cryptography
漏洞归属分支：默认分支
漏洞归属的版本：48.0.0
漏洞修复版本: 49.0.0
CVSS分值：
BaseScore： N/A None
Vector： N/A
漏洞简述：
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
漏洞公开时间：2026-08-03 22:16:52
漏洞创建时间：2026-08-05 03:02:57
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-69248