VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement
CERT/CC says TLS libraries inconsistently enforce Name Constraints, with three assigned CVEs already fixed.
CERT/CC VU#948176 documents library-specific disagreements in enforcing X.509 Name Constraints across DNS, IP, URI, and Common Name handling. Assigned fixes include GnuTLS CVE-2026-3833 in 3.8.13, pyca/cryptography CVE-2026-34073 in 46.0.6, and wolfSSL CVE-2026-3547 in 5.9.0; OpenSSL merged PR #30319 for one URI case. Reports involving Go, Apple Security.framework, Mozilla NSS, LibreSSL, AWS-LC, s2n-tls, and Mbed TLS are fixed, in triage, disputed, or not accepted as security issues. CERT/CC does not report active exploitation and says impact depends on trusted issuance and the affected validation path.
64