CVE-2026-69249

A flaw was found in python-cryptography. When processing invalid certificate chains that include duplicate self-signed certificates, the system recursively invokes the same certificate, leading to an exponential increase in processing time. A remote attacker could exploit this by providing a specially crafted certificate chain, causing resource exhaustion and a denial of service (DoS) condition, making the system unavailable. The integrity of the system's validation is not affected, only its availability.

Red Hat rates this Important (CVSS 3.1 7.5). Duplicate self-signed intermediates can make PolicyBuilder path-building take seconds per request. GitHub CNA CVSS 4.0 is 8.7.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.