CERT/CC Vulnerability Notespublished Oct 13, 18:27 UTC (3d ago)ingested Oct 15, 10:23 UTC

Part of a story covered by 4 sources: “TLS libraries inconsistently enforce X.509 name constraints” — merged summary and timeline →

VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation

mediumVulnerabilityimportance 54CVE-2026-3833 CVE-2026-34073

AI summary · grok-4.7-build

CERT/CC warns TLS libraries inconsistently enforce X.509 name constraints, with fixes for GnuTLS and pyca/cryptography.

CERT/CC VU#573195 describes inconsistent X.509 Name Constraints handling across Go crypto/x509, Apple Security.framework, OpenSSL, LibreSSL, pyca/cryptography, and wolfSSL. Differences cover DNS comparison, IPv4-mapped IPv6 addresses, URI-authority parsing, and wildcards; some are defects and others stem from gaps in RFC 5280. GnuTLS case-sensitivity issue CVE-2026-3833 was fixed in 3.8.13, and pyca/cryptography CVE-2026-34073, where constraints were not checked against the requested peer name, was fixed in 46.0.6. CERT/CC says an attacker would need a trusted signature and a relying application, and that disagreement alone does not show exploitation.

Libraries differ on DNS, IP, URI-authority, and wildcard name constraints.
GnuTLS CVE-2026-3833 was fixed in version 3.8.13.
pyca/cryptography CVE-2026-34073 was fixed in version 46.0.6.
Exploitation needs a trusted signature and an authorization decision on the identity.
CERT/CC says validator disagreement alone does not prove exploitation.

Read the original

VendorsGo OpenSSL Apple LibreSSL pyca wolfSSL GnuTLS

ProductsGo crypto/x509 OpenSSL Apple Security.framework LibreSSL pyca/cryptography wolfSSL GnuTLS

OrganizationsCERT/CC

Tags#x509 #name-constraints #tls #pki #openssl #gnutls #cert-cc

Vulnerabilities mentionedAll →

CVE-2026-340731.7<1%
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
published Mar 31, 2026· cryptography.io cryptography
CVE-2026-38337.4<1%
gnutls: This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for…

Full article583 words · extracted from kb.cert.org · click to collapse

Overview

This note covers differences in how TLS libraries interpret X.509 Name Constraints. A certificate that one library accepts may be rejected by another. Some of those differences are defects; others follow from behavior that RFC 5280 does not fully specify.

Description

The observed differences concern DNS name comparison, IP address handling, URI-authority parsing, and wildcard matching. These include both implementation defects and behavior not fully specified by RFC 5280.

DNS-name comparison. RFC 5280 requires case-insensitive matching for DNS names. GnuTLS compared some names' case-sensitivity at the time of reporting (CVE-2026-3833, later fixed in 3.8.13). A distinct Go report concerns case handling in wildcard parent-constraint lookup, not ordinary hostname comparison.

IP address handling. RFC 5280 defines separate IPv4 and IPv6 encodings and does not say whether IPv4-mapped IPv6 addresses should be treated as IPv4. Some libraries treat the two forms as different, so a constraint written for one form may not apply to the other.

URI-authority parsing. RFC 3986 allows optional userinfo before the host. Implementations differ on which host they extract when @, a colon, or a query or fragment is present. OpenSSL merged PR #30319 for an @ in the path, query, or fragment; a separate userinfo-colon report is not covered by that confirmation. Related differences have been reported in other libraries. A well-formed single @ is handled per RFC 3986 by most implementations.

Wildcard matching. RFC 5280 does not define wildcard SAN semantics. Wildcard-related reports include LibreSSL and wolfSSL. pyca/cryptography checked DNS Name Constraints against certificate SANs but not the requested peer name (CVE-2026-34073, fixed in 46.0.6), as described in the linked vendor advisory.

These differences come from independent design choices. Where the RFC is clear, some reports describe defects; where it is silent, disagreement is expected. No single library should be assumed correct for every deployment.

Impact

An attacker would need a trusted signature over chosen certificate fields, a reachable affected validation path, and an application that uses the accepted identity for authorization. Validator disagreement alone does not establish exploitation. Mixed service-mesh, CDN, or enterprise PKI environments may see different results for the same certificate. Detection is difficult because the certificate can be validly signed.

Solution

CERT/CC is coordinating with the affected projects:
* Go's crypto/x509
* Apple's Security.framework
* OpenSSL*
* LibreSSL
* pyca/cryptography
* wolfSSL

Operators who need high-assurance Name Constraints should test the validator they currently run against their deployment requirements, apply available updates, and keep leaf certificates to explicit SANs (Subject Alternative Names). A second validator helps only when it uses the same inputs and fails closed. Issuance policy and application-layer allow-lists remain useful complements where libraries differ.

Acknowledgements

Thanks to Oleh Konko for discovering and reporting these issues. This document was prepared with AI assistance by Timur Snoke.

Supporting materials include test corpus v3.0.1 and VENDOR_MATRIX_2026-09-06.json (available to case participants; public links will follow agreed disclosure arrangements).

Vendor Information

573195

Filter by status:

Filter by content: Additional information available

Sort by:

References

[RFC 5280 §4.2.1.10 — Name Constraints](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10)
[RFC 5280 §4.2.1.6 — Subject Alternative Name](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.6)
[RFC 3986 §3.2 — URI Authority Component](https://datatracker.ietf.org/doc/html/rfc3986#section-3.2)
[CVE-2026-3833 — GnuTLS Name Constraints case-sensitivity](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833)
[GnuTLS 3.8.13 Release](https://www.gnutls.org/news.html)
[CVE-2026-34073 — pyca/cryptography wildcard Name Constraints bypass](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34073)
[GHSA-m959-cc7f-wv43 — pyca/cryptography wildcard advisory](https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43)
[GHSA-xgp8-3hg3-c2mh — rustls/webpki wildcard Name Constraints bypass](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh)
[GHSA-965h-392x-2mh5 — rustls/webpki URI Name Constraints bypass](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5)
[pyca/cryptography v46.0.6](https://cryptography.io/en/latest/changelog/)
[OpenSSL PR #30319](https://github.com/openssl/openssl/pull/30319)
[OpenSSL PR #30318](https://github.com/openssl/openssl/pull/30318)
[wolfSSL PR #991](https://github.com/wolfssl/wolfssl/pull/9991)

Other Information

API URL:	VINCE JSON \| CSAF
Date Public:	2026-10-13
Date First Published:	2026-10-13
Date Last Updated:	2026-10-14 13:34 UTC
Document Revision:	2

VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation

Vulnerabilities mentionedAll →

Overview

Description

Impact

Solution

Acknowledgements

Vendor Information

References

Other Information

VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement

VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic

Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595)

sslx: A fast, modern alternative to OpenSSL's CLI

Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595)

VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement

USN-8927-1: curl vulnerabilities

A UAF turned RCE

Claude Helps Secure Open Source as Anthropic Offers Free Vulnerability Scanning

US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools

Anthropic offers free AI security scans to open-source maintainers

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-34073	cryptography is a package designed to expose cryptographic primitives and recipes to Python developers cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6. NVD description · AI analysis pending	1.7	<1%		cryptography.io cryptography	—	Mar 31, 2026
CVE-2026-3833	gnutls: This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for… A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure. NVD description · AI analysis pending	7.4	<1%	PoC	gnu gnutls gnu hardened images gnu openshift container platform +1 more	—	Apr 30, 2026