Red Hat Security Advisory: python3.14-cryptography security update
Description
A high severity vulnerability (CVE-2026-69248) exists in the python3.14-cryptography package for Red Hat Enterprise Linux 9. The issue allows the verifier to accept wildcard DNS names that can escape from permittedSubtrees. Red Hat has released patches to address this vulnerability in updated packages.
Affected software
pkg:rpm/redhat/python3-cryptographyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-69248 is a vulnerability in the python3.14-cryptography package used in Red Hat Enterprise Linux 9. It allows the certificate verifier to incorrectly accept wildcard DNS names that escape the constraints of permittedSubtrees, potentially undermining certificate validation. This flaw has been addressed by Red Hat through updated package releases. The advisory indicates that versions prior to the fixed release are affected, and the issue is rated as high severity.
Potential Impact
The vulnerability could allow bypassing of certificate validation restrictions related to permittedSubtrees, which may lead to acceptance of unauthorized wildcard DNS names in certificates. This undermines the trust model of certificate verification, potentially impacting security mechanisms relying on correct certificate validation.
Mitigation Recommendations
Red Hat has released official patches to remediate this vulnerability. Users should apply the updated python3.14-cryptography packages as per Red Hat's advisory RHSA-2026:64774. No additional mitigation steps are indicated beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:64774
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-69249"]
- State
- PUBLISHED
Threat ID: 6a9f910bacd9273b49ff26a9
Added to database: 09/08/2026, 04:37:31 UTC
Last enriched: 10/21/2026, 20:22:27 UTC
Last updated: 10/24/2026, 03:05:10 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.