The vulnerability arises when the cryptography library processes certificate chains that contain duplicate self-signed certificates. The recursive build_chain_inner function fails to deduplicate candidates, causing exponential growth in decision paths. This is a CWE-400 Resource Management: Uncontrolled Resource Consumption weakness. Although the algorithm guarantees termination through a maximum depth limit, an attacker can craft a chain that forces the validator to spend excessive time, resulting in a denial-of-service condition. The amplification could form the basis for a resource exhaustion denial of service attack. The flaw does not affect the integrity or confidentiality of the system, but it can exhaust CPU resources during TLS handshakes or other operations that perform certificate validation.

The issue affects the pyca:cryptography package in any version before 49.0.0. Systems that rely on this library for TLS or other cryptographic operations—including web servers, client applications, and automated scripts—are potentially impacted if they use an unpatched version.

The vulnerability carries a CVSS score of 8.7, indicating a high severity. Exploit probability is unclear because an EPSS score is not available, and the flaw is not listed in CISA's KEV catalog. A malicious actor could craft a certificate chain containing duplicate self‑signed intermediates and deliver it to a target that loads the vulnerable library, forcing the host to perform extensive chain validation and consume CPU time. The attack would succeed in environments where the library is invoked during authentication or data signing, and would be mitigated only by applying the vendor patch or implementing defensive measures.