python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - python-cryptography is a package designed to expose cryptographic primitives and recipes to Python
    developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of
    self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential
    blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents
    unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the
    processing to easily take more than 5s to reject in testing. This amplification could form the basis for a
    resource exhaustion denial of service attack. The core issue arises in the recursive nature of
    build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness
    of validation is not affected, the integrity of a system cannot be compromised through this vector, only
    its availability. This issue is fixed in 49.0.0. (CVE-2026-69249)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - python-cryptography is a package designed to expose cryptographic primitives and recipes to Python     developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of     self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential     blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents     unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the     processing to easily take more than 5s to reject in testing. This amplification could form the basis for a     resource exhaustion denial of service attack. The core issue arises in the recursive nature of     build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness     of validation is not affected, the integrity of a system cannot be compromised through this vector, only     its availability. This issue is fixed in 49.0.0. (CVE-2026-69249)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
445600	SCA: security update for cryptography (GHSA-jwv3-5hgf-82ww)	Tenable Cloud Security	SCA Checks	Local	high
445600	SCA: security update for cryptography (GHSA-jwv3-5hgf-82ww)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
331890	Linux Distros Unpatched Vulnerability : CVE-2026-69249	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-69249

high

Tenable Plugins

high

high

high