PyPI/cryptography CVE-2026-69249: high, EPSS 0.25%

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

Action: Upgrade cryptography to 49.0.0 or later.

pip install cryptography==49.0.0

Affected

Fixed versions

Sources

• osv: GHSA-jwv3-5hgf-82ww
• https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww
• https://nvd.nist.gov/vuln/detail/CVE-2026-69249
• https://github.com/pyca/cryptography/pull/14960
• https://github.com/pyca/cryptography/commit/3763aa79b
• https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582
• https://github.com/pyca/cryptography
• https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml

CVE-2026-69249 · published 2026-08-03T21:26:50Z · modified 2026-09-24T14:45:10.238420831Z · JSON