Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| pyca | cryptography | affected |
|
No data.
No data.
No data available yet.
No remediation available yet.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-m959-cc7f-wv43 | cryptography has incomplete DNS name constraint enforcement on peer names |
Tue, 31 Mar 2026 03:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6. | |
| Title | cryptography has incomplete DNS name constraint enforcement on peer names | |
| Weaknesses | CWE-295 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-03-31T02:04:36.275Z
Reserved: 2026-03-25T16:21:40.868Z
Link: CVE-2026-34073
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-31T03:15:59.123
Modified: 2026-03-31T03:15:59.123
Link: CVE-2026-34073
Redhat
No data.
OpenCVE Enrichment
No data.