VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement
CERT/CC says TLS libraries inconsistently enforce Name Constraints, with three assigned CVEs already fixed.
64
Vendor
GnuTLS
- Mentions · 7d0
- Mentions · 30d2
- All mentions3
- First seenSep 21, 2026
- Last mentioned28d ago
Timeline
3 articles · newest firstVU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation
CERT/CC warns TLS libraries inconsistently enforce X.509 name constraints, with fixes for GnuTLS and pyca/cryptography.
54
Exim Mail Server 4.100.1 Fixes 4 Security Flaws Including SMTP Smuggling and Heap Corruption
Exim 4.100.1 patches four flaws, including high-severity Proxy Protocol heap corruption, uninitialized data leak, GnuTLS use-after-free, and SMTP smuggling.
55
Related CVEs
by mentions- CVE-2026-3833<1%7.4gnutls: This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for…
- CVE-2026-34073<1%1.7cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
- CVE-2026-3547<1%7.5Out-of-bounds read in ALPN parsing due to incomplete validation
Appears with
- pycavendor · 2
- wolfSSLproduct · 2
- pyca/cryptographyproduct · 2
- Applevendor · 2
- OpenSSLproduct · 2
- OpenSSLvendor · 2
- LibreSSLproduct · 2
- Go crypto/x509product · 2
- CERT/CCorganization · 2
- wolfSSLvendor · 2
- GnuTLSproduct · 2
- Govendor · 1
- pycaorganization · 1
- Security.frameworkproduct · 1
- NSSproduct · 1
- watchTowrorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.