VDB
GHSA-m2h6-j472-rp4c
GHSA-m2h6-j472-rp4c
PUBLISHED
CVSS 6.900000095367432 MEDIUM
Record from GitHub Advisory Database · Published August 3, 2026
cryptography is fixed in 49.0.0 (PyPI)
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| cryptography | PyPI | 49.0.0 |
| vllm-openai-cuda-12.9 | Chainguard | 0.29.0-r3 |
| openstack-glance-2025.2 | Chainguard | 31.1.0_git20260708-r2 |
| mlflow | Wolfi | 3.16.0-r0 |
| openstack-glance-2025.1 | Chainguard | 30.2.0_git20260616-r8 |
| apache-beam-python-3.12-sdk | Chainguard | 2.75.0-r1 |
| kserve | Wolfi | 0.20.0-r7 |
| datadog-agent-fips-7.77 | Chainguard | 7.77.3-r36 |
| az | Wolfi | 2.91.0-r0 |
| apache-beam-python-3.13-sdk | Chainguard | 2.75.0-r2 |
| openstack-nova-2025.2 | Chainguard | 32.2.0_git20260715-r2 |
| mlflow | Chainguard | 3.16.0-r0 |
7 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 4.0
6.900000095367432
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | cryptography | |
| chainguard | vllm-openai-cuda-12.9 | 0 |
| chainguard | openstack-glance-2025.2 | 0 |
| PyPI | cryptography | |
| wolfi | mlflow | 0 |
| chainguard | openstack-glance-2025.1 | 0 |
| chainguard | apache-beam-python-3.12-sdk | 0 |
| wolfi | kserve | 0 |
| chainguard | datadog-agent-fips-7.77 | 0 |
| wolfi | az | 0 |
| chainguard | apache-beam-python-3.13-sdk | 0 |
| chainguard | openstack-nova-2025.2 | 0 |
| chainguard | mlflow | 0 |
| chainguard | openstack-nova-2025.1 | 0 |
| chainguard | openstack-nova-2026.1 | 0 |
| chainguard | vllm-openai-cuda-13.0 | 0 |
| chainguard | apache-beam-python-3.11-sdk | 0 |
| chainguard | az | 0 |
| chainguard | dbt-snowflake | 0 |
| chainguard | openstack-glance-2026.1 | 0 |
Timeline
- Aug 3, 2026 CVE Published
- Sep 6, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-m2h6-j472-rp4c
vulnetix vdb fixes GHSA-m2h6-j472-rp4cOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-m2h6-j472-rp4c/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart