Is CVE-2026-34073 actively exploited?

No active exploitation of CVE-2026-34073 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34073 be exploited remotely?

Yes. CVE-2026-34073 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34073?

CVE-2026-34073 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-34073

MEDIUM

CVE-2026-34073

CWE-295Published: March 31, 2026· Updated: Apr 6, 2026

5.3

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:6.2th

Official Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

NVD Source

Technical Analysis

CVE-2026-34073 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.