My original report isn't 100% accurate, it looks like to solve the issue two PRs from upstream need to be backported:
https://github.com/pyca/cryptography/pull/4836 https://github.com/pyca/cryptography/pull/4889 Thanks, Valentin Gutierrez
- Bug#941413: python3-cryptography: aia encoding memory ... Valentín Gutierrez
- Bug#941413: Valentín Gutierrez
