CVE-2026-34073 cryptography has incomplete DNS name constraint enforcement on peer names
Attackers can bypass DNS name constraints in the Python cryptography library, allowing unauthorized peer validation against restricted domains.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34073?
CVE-2026-34073 is a low-severity vulnerability in pyca cryptography, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.
Weakness: CWE-295
Which versions are affected by CVE-2026-34073?
3 open source packages ship an affected version, including cryptography. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cryptography PyPI | All versions | 46.0.6 |
cryptography PyPI | All versions | 46.0.6 |
cryptography PyPI | All versions | 46.0.6 |
Linux distribution packages (3)
python-cryptography SUSE:Linux Micro 6.0 | All versions | 42.0.4-4.1 |
python-cryptography SUSE:Linux Micro 6.1 | All versions | 42.0.4-slfo.1.1_4.1 |
python-cryptography openSUSE:Tumbleweed | All versions | 46.0.6-1.1 |
Products include Cryptography.io Cryptography.
How do I fix CVE-2026-34073?
Upgrade cryptography to 46.0.6 or later.
Is CVE-2026-34073 being exploited?
There is no known exploitation of CVE-2026-34073 in the wild and no public exploit code.
Other vulnerabilities in pyca cryptography
- CVE-2020-36242 PyCA Cryptography symmetrically encrypting large values can lead to integer overflow
- CVE-2026-26007 cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
- CVE-2024-26130 cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
- CVE-2023-38325 cryptography mishandles SSH certificates
- CVE-2026-39892 cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
Sources
Also known as ALPINE-CVE-2026-34073, BELL-CVE-2026-34073, CLEANSTART-2026-JG72912, CLEANSTART-2026-VN38539, CLSA-2026-1784164006, DEBIAN-CVE-2026-34073 and 24 more.