CVE-2026-69249

Name of the Vulnerable Software and Affected Versions python-cryptography versions prior to 49.0.0

Description When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. This occurs because the build chain inner() function does not de-duplicate against previously analyzed candidates. An attacker-controlled certificate chain can cause the process to take significant time to reject, which could be used to launch a resource exhaustion denial of service attack. This issue affects the availability of the system, but does not compromise its integrity as the correctness of the validation remains unaffected.

Recommendations Update python-cryptography to version 49.0.0.