Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-34073

23
FAUCET Score

CVE-2026-34073 is a low-severity vulnerability (CVSS 1.7) affecting the 'cryptography' Python package, specifically versions prior to 46.0.6. This flaw allowed for the bypass of DNS name constraints, enabling a peer to validate against a wildcard certificate even when an excluded subtree constraint was present in a parent certificate. The vulnerability has a network attack vector and high attack complexity, resulting in a low integrity impact. There is no evidence of active exploitation, and no public exploit code is currently available, though it has received minimal community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
< 46.0.6CPE matchmatch criteria
cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:*

CVSS Data

CVSS version used by this source: 4.0

1.7LOW

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
LOW
VS Availability
NONE
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
UNREPORTED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.15%
Probability of exploitation in next 30 days
EPSS Percentile
5.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0015 is in the 1st percentile among its peer group of 23,701 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

pippatch availablevia ghsa
Product: cryptographyFixed in: 46.0.6
github_advisoryvendor investigatingvia nvd_reference
View patch

Vendor Advisories (2)

pipGHSA-m959-cc7f-wv43low

cryptography has incomplete DNS name constraint enforcement on peer names

Mar 27, 2026
microsoft2026-Mar/CVE-2026-34073Low

cryptography has incomplete DNS name constraint enforcement on peer names

Mar 10, 2026

References

github.com / pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43
Vendor Advisory