{"id":"AZL-94584","summary":"CVE-2026-69249 affecting package python-cryptography 42.0.5-4","details":"python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.","modified":"2026-08-30T05:26:50Z","published":"2026-08-03T22:16:52Z","upstream":["CVE-2026-69249"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69249"}],"affected":[{"package":{"name":"python-cryptography","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/python-cryptography"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"42.0.5-4"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-94584.json"}}],"schema_version":"1.9.0"}