CVE-2026-34073

This vulnerability allows an attacker to validate a certificate against a wildcard certificate even when a Name Constraint explicitly excludes the target domain. For example, an attacker could use a certificate for *.example.com to validate a connection to bar.example.com even if bar.example.com is excluded in the certificate's Name Constraint. This can lead to man-in-the-middle attacks, where an attacker intercepts and potentially modifies communications between a client and a server. The impact is particularly severe in environments where certificate validation is critical for security, such as financial transactions or secure communication channels. The lack of proper validation opens the door to unauthorized access and data compromise.

Applications and systems relying on the cryptography library for secure communication, particularly those using wildcard certificates or relying on Name Constraints for enhanced security, are at risk. This includes web applications, APIs, and any system performing TLS/SSL connections where certificate validation is a critical security control.

• python / library:

import cryptography
print(cryptography.__version__)

• python / library: Check for versions <= 46.0.5 using pip:

pip show cryptography

• generic web: Inspect TLS handshake logs for unusual certificate validation patterns or connections to unexpected domains.

1. 2026-03-27Disclosure

   disclosure

1. Gereserveerd2026-03-25
2. Gepubliceerd2026-03-27
3. Gewijzigd2026-04-06
4. EPSS bijgewerkt2026-04-07

The primary mitigation is to upgrade to cryptography version 46.0.6 or later. If upgrading is not immediately feasible, consider implementing stricter DNS validation policies at the network level to prevent connections to untrusted domains. While not a direct fix, using a Web Application Firewall (WAF) that can inspect TLS connections and enforce certificate validation policies can provide an additional layer of defense. Thoroughly review certificate validation configurations and ensure that Name Constraints are correctly defined and enforced to minimize the attack surface. After upgrade, confirm validation by attempting a connection to a domain with a Name Constraint and verifying that the connection fails as expected.