CVE-2026-69248

Name of the Vulnerable Software and Affected Versions cryptography versions prior to 49.0.0

Description A flaw exists in the verifier where a wildcard pattern in the DNS Subject Alternative Name (SAN) of a leaf certificate is incorrectly treated as matching a more-specific permitted constraint of an intermediate constrained Certificate Authority (CA). Specifically, the DNSConstraint::matches function allows a wildcard such as *.example.com to expand to sibling names like bar.example.com, even if the CA is restricted to foo.example.com. This behavior enables the acceptance of an invalid certificate chain, allowing a scope escape outside of the permitted names.

Recommendations Update to version 49.0.0.