[GHSA-jwv3-5hgf-82ww] python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

[dguerri]

Updates

• Affected products

Comments
Please add an introduced: "42.0.0" lower bound to the OSV JSON ranges block (or update the range to >= 42.0.0, < 49.0.0).

Reason for change:
The resource exhaustion Denial-of-Service flaw outlined in CVE-2026-69249 is specifically isolated to the recursive parsing logic within the build_chain_inner function.

This function—and the initial Rust-based X.509 path validation engine it belongs to—was first introduced to the cryptography library in version 42.0.0 via commit 3763aa79b6d05e245973ee273f9a04cbab6eaab6 pyca/cryptography@3763aa7.

Because versions prior to 42.0.0 do not contain this underlying code or functionality, they are not structurally vulnerable to this exploit. Without this strict lower bound, automated vulnerability and supply-chain scanners (OSV) are broadly alerting on legacy versions (such as 3.x and 41.x) as false positives.

[github]

Hi there @alex! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory