How severe is CVE-2026-34073?

CVE-2026-34073 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2026-34073 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-34073?

CVE-2026-34073 affects Cryptography.io Cryptography. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-34073?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-34073 have an EU (EUVD) identifier?

Yes. CVE-2026-34073 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-17284.

When was CVE-2026-34073 published?

CVE-2026-34073 was published on 2026-03-31 and last updated on 2026-06-17.

CVE-2026-34073

CVE-2026-34073 is a medium-severity vulnerability in Cryptography.io Cryptography with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-295.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 1.7
EPSS exploit prediction: 0% (5th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-17284
Weakness: CWE-295
Affected product: Cryptography.io Cryptography
Published: 2026-03-31
Last modified: 2026-06-17

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

Frequently asked questions

What is CVE-2026-34073?: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.
How severe is CVE-2026-34073?: CVE-2026-34073 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2026-34073 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-34073?: CVE-2026-34073 affects Cryptography.io Cryptography. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-34073?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-34073 have an EU (EUVD) identifier?: Yes. CVE-2026-34073 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-17284.
When was CVE-2026-34073 published?: CVE-2026-34073 was published on 2026-03-31 and last updated on 2026-06-17.

References

https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43

Affected products (1)

cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:*

More vulnerabilities in Cryptography.io Cryptography

CVE-2026-39892 — Critical (CVSS 9.8): cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to…
CVE-2020-36242 — Critical (CVSS 9.1): In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt…
CVE-2024-26130 — High (CVSS 7.5): cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in…
CVE-2023-50782 — High (CVSS 7.5): A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured…
CVE-2023-38325 — High (CVSS 7.5): The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
CVE-2016-9243 — High (CVSS 7.5): HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.

All CVEs affecting Cryptography.io Cryptography →

Other CWE-295 (Improper Certificate Validation) vulnerabilities

CVE-2026-4370 — Critical (CVSS 10.0): A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the…
CVE-2026-30836 — Critical (CVSS 10.0): Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6…
CVE-2025-68121 — Critical (CVSS 10.0): During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between…
CVE-2022-20703 — Critical (CVSS 10.0): Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker…
CVE-2021-1471 — Critical (CVSS 9.9): Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms…
CVE-2026-20184 — Critical (CVSS 9.8): A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed…

Browse all CWE-295 (Improper Certificate Validation) vulnerabilities →