CVE-2026-69247: 
Wolfi vulnerability analysis and mitigation

CVE-2026-69247 is a Bleichenbacher oracle vulnerability in the Python cryptography package (pyca/cryptography) affecting versions 44.0.0 through 49.x. The functions pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime exposed distinguishable error messages and timing differences during PKCS#7 EnvelopedData decryption, enabling an attacker to mount a Bleichenbacher-style adaptive chosen-ciphertext attack against the RSA-wrapped content-encryption key. It was introduced in version 44.0.0 and fixed in 50.0.0. The vulnerability was reported by @X1AOxiang and published on July 31, 2026, with a CVSS v4.0 base score of 8.2 (High) (Github Advisory, pyca Advisory).

The root cause is a combination of CWE-208 (Observable Timing Discrepancy) and CWE-209 (Generation of Error Message Containing Sensitive Information). The decryption pipeline performed: (1) RSA PKCS#1 v1.5 decryption of encryptedKey, (2) construction of an AES cipher from the result, and (3) AES-CBC decryption with PKCS#7 unpadding. Each stage failed with a distinct, distinguishable error — invalid RSA padding raised Decryption failed; valid padding with a wrong-length key disclosed the exact recovered length via Invalid key size (N) for AES.; a correct-length but wrong key raised Invalid padding bytes. The wrong-length case also returned early, making the distinction observable by timing. This oracle is reachable only when the underlying cryptographic library lacks implicit rejection (OpenSSL 3.0/3.1, LibreSSL, BoringSSL); OpenSSL 3.2+ (used in official wheels) returns a synthetic pseudorandom plaintext for invalid padding, closing the error channel for that case (pyca Advisory, Fix PR).

Successful exploitation allows an attacker to recover the AES content-encryption key used to protect an S/MIME or PKCS#7 EnvelopedData message, resulting in full confidentiality loss of the encrypted content. There is no integrity or availability impact. The attack targets services that automatically decrypt attacker-supplied EnvelopedData (e.g., S/MIME gateways, mail filters) and return distinguishable outcomes, enabling adaptive queries at high volume to reconstruct the key. The advisory also notes a residual, unfixed CBC padding oracle inherent to PKCS#7 that can recover plaintext at approximately 256 queries per byte without key recovery, on all backends (Github Advisory).

1. Identify a vulnerable oracle service: Locate a service using pyca/cryptography 44.0.0–49.x that automatically decrypts PKCS#7 EnvelopedData (e.g., an S/MIME gateway or mail filter) and returns distinguishable outcomes (error messages, status codes, or timing differences) for decryption failures.
2. Obtain the victim's certificate: Retrieve the recipient's X.509 certificate, which is typically publicly available or embedded in signed messages.
3. Craft a valid EnvelopedData structure: Build a PKCS#7 EnvelopedData message addressed to the victim's certificate, using a known or chosen encryptedKey value.
4. Submit adaptive queries: Send crafted EnvelopedData messages to the oracle service with modified encryptedKey values. Observe the distinguishable error responses — Decryption failed (invalid RSA padding), Invalid key size (N) for AES. (valid padding, wrong length, disclosing N), or Invalid padding bytes. (correct length, wrong key) — or measure timing differences.
5. Apply Bleichenbacher's algorithm: Use the oracle responses to iteratively narrow down the RSA plaintext (the content-encryption key), following the adaptive chosen-ciphertext attack methodology from Bleichenbacher '98, requiring thousands to millions of queries.
6. Recover the content-encryption key: Once the RSA plaintext is recovered, use it as the AES key to decrypt the target EnvelopedData message and access the plaintext content.

Note: This attack is only feasible against services linked to OpenSSL 3.0/3.1, LibreSSL, or BoringSSL; OpenSSL 3.2+ mitigates Case 1 via implicit rejection. (pyca Advisory, Fix PR)

• Network: Unusually high volume of S/MIME or PKCS#7 decryption requests to an automated mail gateway or filter from a single source IP or small IP range; requests containing structurally valid but semantically crafted EnvelopedData with modified encryptedKey fields.
• Logs: Application or service logs showing repeated decryption errors such as Decryption failed, Invalid key size (N) for AES., or Invalid padding bytes. in rapid succession for the same recipient certificate; anomalous patterns of mixed error types from the same source.
• Behavioral: Statistically abnormal decryption request rates (thousands to millions of requests) targeting a single recipient certificate over a short time window; automated clients submitting messages with identical structure but varying encryptedKey byte sequences.

Upgrade pyca/cryptography to version 50.0.0 or later, which resolves the oracle by implementing RFC 3218 mitigations: the expected key length is determined before RSA decryption, and any failure (invalid padding or wrong-length key) substitutes a random key of the correct length, causing all failure paths to proceed identically and report the same error. There is no configuration-based workaround for affected versions; upgrading is the only remediation. Additionally, operators of S/MIME gateways or automated decryption services should avoid exposing distinguishable decryption outcomes to external parties regardless of library version, as a residual CBC padding oracle (inherent to PKCS#7) remains unfixed by design (Github Advisory, Fix Commit).

The fix was authored and merged by the pyca/cryptography maintainers (alex and reaperhulk) on July 31, 2026, with credit given to reporter @X1AOxiang. The advisory was rated "Moderate" by the pyca project but classified as "High" severity (8.2) in the GitHub Advisory Database. The fix also added documentation warnings to all three affected decrypt functions noting the residual CBC padding oracle inherent to PKCS#7, advising users to avoid decrypting untrusted EnvelopedData (pyca Advisory, Fix PR).