CVE-2026-34073: DNS Validation Bypass in cryptography

This vulnerability allows an attacker to validate a certificate against a wildcard certificate even when a Name Constraint explicitly excludes the target domain. For example, an attacker could use a certificate for *.example.com to validate a connection to bar.example.com even if bar.example.com is excluded in the certificate's Name Constraint. This can lead to man-in-the-middle attacks, where an attacker intercepts and potentially modifies communications between a client and a server. The impact is particularly severe in environments where certificate validation is critical for security, such as financial transactions or secure communication channels. The lack of proper validation opens the door to unauthorized access and data compromise.

1. Reserved2026-03-25
2. Published2026-03-27
3. Modified2026-04-06
4. EPSS updated2026-04-07

The primary mitigation is to upgrade to cryptography version 46.0.6 or later. If upgrading is not immediately feasible, consider implementing stricter DNS validation policies at the network level to prevent connections to untrusted domains. While not a direct fix, using a Web Application Firewall (WAF) that can inspect TLS connections and enforce certificate validation policies can provide an additional layer of defense. Thoroughly review certificate validation configurations and ensure that Name Constraints are correctly defined and enforced to minimize the attack surface. After upgrade, confirm validation by attempting a connection to a domain with a Name Constraint and verifying that the connection fails as expected.