{"id":"AZL-94584","summary":"CVE-2026-69249 affecting package python-cryptography for versions less than 42.0.5-6","details":"python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.","modified":"2026-11-08T05:33:04Z","published":"2026-08-03T22:16:52Z","upstream":["CVE-2026-69249"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69249"}],"affected":[{"package":{"name":"python-cryptography","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/python-cryptography"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.0.5-6"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-94584.json"}}],"schema_version":"1.9.2"}