{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/cryptography--48.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-69249"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["cryptography (\u003c= 48.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Python cryptography library (versions \u0026lt;= 48.0.0) contains a resource exhaustion vulnerability (CVE-2026-69249) within its certificate chain validation logic. The internal function \u003ccode\u003ebuild_chain_inner\u003c/code\u003e fails to implement de-duplication when analyzing potential certificate issuers during recursive path building. An attacker can craft a malicious certificate chain containing redundant, self-signed certificates, which forces the validation engine to re-process the same candidates multiple times. This recursion leads to exponential processing time increases, causing significant CPU and memory consumption. While the implementation enforces a maximum chain depth to ensure termination, the amplification factor is sufficient to exceed typical timeouts (e.g., 5 seconds), facilitating a denial-of-service (DoS) attack against applications that process untrusted certificate input. This issue does not compromise the cryptographic integrity or validity of processed certificates, but it degrades service availability for any system relying on this library for certificate chain validation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker generates a malicious certificate chain containing multiple duplicate, self-signed intermediate certificates.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers the crafted certificate chain to an application that utilizes the \u003ccode\u003ecryptography\u003c/code\u003e library for TLS or certificate verification.\u003c/li\u003e\n\u003cli\u003eThe application passes the untrusted chain to the \u003ccode\u003ePolicyBuilder.build_server_verifier\u003c/code\u003e or a similar verification interface.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ebuild_chain_inner\u003c/code\u003e function begins recursive validation of the provided certificates.\u003c/li\u003e\n\u003cli\u003eThe validation engine encounters the duplicate self-signed certificates but lacks logic to track or skip already-analyzed candidates.\u003c/li\u003e\n\u003cli\u003eThe recursive calls to \u003ccode\u003ebuild_chain_inner\u003c/code\u003e exponentially multiply as the engine attempts to resolve redundant paths through the same set of certificates.\u003c/li\u003e\n\u003cli\u003eThe process consumes high CPU cycles and memory over several seconds, effectively blocking the application thread from performing legitimate tasks.\u003c/li\u003e\n\u003cli\u003eThe application hits a latency threshold or resource limit, resulting in a denial-of-service state for that verification process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a localized denial-of-service for any process invoking the certificate validation routines. This vulnerability targets a fundamental component used in various networking and security products, potentially impacting any sector that parses user-supplied certificate chains. While this does not permit unauthorized access or data exfiltration, the potential for service disruption is significant for high-traffic infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Python cryptography library to a patched version (fixed in versions after 48.0.0) to implement the required candidate de-duplication logic in \u003ccode\u003ebuild_chain_inner\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit applications that perform certificate chain validation on untrusted input to ensure they implement timeouts or rate-limiting for the validation logic.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for high-latency certificate validation events that correlate with large numbers of certificate inputs (CVE-2026-69249).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-03T23:41:42Z","date_published":"2026-08-03T23:41:42Z","id":"https://feed.craftedsignal.io/briefs/2026-08-cryptography-dos/","summary":"An exponential complexity vulnerability in the certificate chain validation logic of the Python cryptography library allows for denial-of-service attacks via resource exhaustion using crafted, redundant certificate chains.","title":"Resource Exhaustion in Python cryptography Certificate Chain Validation","url":"https://feed.craftedsignal.io/briefs/2026-08-cryptography-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cryptography (\u003c= 48.0.0)","version":"https://jsonfeed.org/version/1.1"}