Story · 2 sources · 4 articlesfirst Oct 13, 18:27 UTCupdated Oct 14, 18:50 UTC (2d ago)

TLS libraries inconsistently enforce X.509 name constraints

mediumVulnerabilityimportance 64CVE-2026-3833 CVE-2026-34073 CVE-2026-3547 CVE-2026-5263 CVE-2026-33810

What's new: First coverage.

Merged summary · grok-4.7-build · rewritten as coverage arrives

CERT/CC and oss-security report inconsistent X.509 name-constraint checks in TLS libraries, with several fixed CVEs and no exploitation reported.

CERT/CC published VU#573195, VU#948176, and VU#410595 on inconsistent X.509 Name Constraints enforcement across TLS libraries, including DNS, IP, URI, wildcard, and email handling. Fixes cited by CERT/CC include GnuTLS CVE-2026-3833 in 3.8.13 and pyca/cryptography CVE-2026-34073 in 46.0.6; VU#948176 additionally assigns wolfSSL CVE-2026-3547, fixed in 5.9.0, and says OpenSSL merged PR #30319 for one URI case. VU#948176 says thirteen records involving Go, Apple Security.framework, Mozilla NSS, LibreSSL, AWS-LC, s2n-tls, and Mbed TLS are fixed, in triage, disputed, or not accepted, while VU#573195 lists Go, OpenSSL, Apple, LibreSSL, pyca/cryptography, and wolfSSL without the wolfSSL CVE. VU#410595 covers five BoringSSL findings: two DNS issues were fixed on 2026-03-04 in commit 5774eca, one URI-host issue remains under coordination, and two email findings were disputed or declined. Sources disagree on the CVE set because the oss-security post by Oleh Konko adds CVE-2026-5263 and CVE-2026-33810 but omits CVE-2026-3547; none reports exploitation, and CERT/CC says a trusted signature and an authorizing application are required and that BoringSSL users such as Chrome or Android are not automatically affected.

CERT/CC notes VU#573195 (2026-10-13) and VU#948176 and VU#410595 (2026-10-14) describe inconsistent X.509 Name Constraints handling across TLS libraries.
GnuTLS CVE-2026-3833 was fixed in 3.8.13, and pyca/cryptography CVE-2026-34073 was fixed in 46.0.6.
VU#948176 also assigns wolfSSL CVE-2026-3547, fixed in 5.9.0, says OpenSSL merged PR #30319 for one URI case, and cites thirteen records that are fixed, in triage, disputed, or not accepted.
Oleh Konko’s oss-security post lists CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, and CVE-2026-33810, but not CVE-2026-3547.
Of five BoringSSL findings, wildcard and trailing-dot DNS issues were fixed on 2026-03-04 in commit 5774eca; a URI-host issue is accepted, while email findings were disputed or declined.
No source reports active exploitation; impact requires a trusted signature and authorization of the accepted name, and CERT/CC says BoringSSL users are not automatically affected.

VendorsGnuTLS Google OpenBSD wolfSSL pyca OpenSSL Apple Mozilla Amazon Go LibreSSL

ProductsGnuTLS Go crypto/x509 LibreSSL wolfSSL pyca/cryptography OpenSSL Security.framework NSS AWS-LC s2n-tls Apple Security.framework BoringSSL

OrganizationsCERT/CC GnuTLS

Coverage timelineoldest first · each row is one article

Oct 13, 18:27 UTC · 3d ago
CERT/CC Vulnerability Notes· 54
VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation
CERT/CC warns TLS libraries inconsistently enforce X.509 name constraints, with fixes for GnuTLS and pyca/cryptography.
Oct 14, 15:11 UTC · 2d ago
CERT/CC Vulnerability Notes· 64
VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement
CERT/CC says TLS libraries inconsistently enforce Name Constraints, with three assigned CVEs already fixed.
Oct 14, 15:11 UTC · 2d ago
CERT/CC Vulnerability Notes· 52
VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic

Vulnerabilities in this storyAll →

CVE-2026-338108.2<1%
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different…
published Apr 8, 2026· golang go
CVE-2026-340731.7<1%
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-33810	When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different… When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool. NVD description · AI analysis pending	8.2	<1%		golang go	—	Apr 8, 2026
CVE-2026-34073	cryptography is a package designed to expose cryptographic primitives and recipes to Python developers cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6. NVD description · AI analysis pending	1.7	<1%		cryptography.io cryptography	—	Mar 31, 2026
CVE-2026-3547	Out-of-bounds read in ALPN parsing due to incomplete validation Out-of-bounds read in ALPN parsing due to incomplete validation. wolfSSL 5.8.4 and earlier contained an out-of-bounds read in ALPN handling when built with ALPN enabled (HAVE_ALPN / --enable-alpn). A crafted ALPN protocol list could trigger an out-of-bounds read, leading to a potential process crash (denial of service). Note that ALPN is disabled by default, but is enabled for these 3rd party compatibility features: enable-apachehttpd, enable-bind, enable-curl, enable-haproxy, enable-hitch, enable-lighty, enable-jni, enable-nginx, enable-quic. NVD description · AI analysis pending	7.5	<1%		wolfssl wolfssl	—	Mar 19, 2026
CVE-2026-3833	gnutls: This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for… A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure. NVD description · AI analysis pending	7.4	<1%	PoC	gnu gnutls gnu hardened images gnu openshift container platform +1 more	—	Apr 30, 2026
CVE-2026-5263	URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid. NVD description · AI analysis pending	7.0	<1%		wolfssl wolfssl	—	Apr 9, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-33810

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different…

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

NVD description · AI analysis pending

8.2

<1%

golang go

—

Apr 8, 2026

CVE-2026-34073

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

NVD description · AI analysis pending

1.7

<1%

cryptography.io cryptography

—

Mar 31, 2026

CVE-2026-3547

Out-of-bounds read in ALPN parsing due to incomplete validation

Out-of-bounds read in ALPN parsing due to incomplete validation. wolfSSL 5.8.4 and earlier contained an out-of-bounds read in ALPN handling when built with ALPN enabled (HAVE_ALPN / --enable-alpn). A crafted ALPN protocol list could trigger an out-of-bounds read, leading to a potential process crash (denial of service). Note that ALPN is disabled by default, but is enabled for these 3rd party compatibility features: enable-apachehttpd, enable-bind, enable-curl, enable-haproxy, enable-hitch, enable-lighty, enable-jni, enable-nginx, enable-quic.

NVD description · AI analysis pending

7.5

<1%

wolfssl wolfssl

—

Mar 19, 2026

CVE-2026-3833

gnutls: This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for…

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

NVD description · AI analysis pending

7.4

<1%

PoC

gnu gnutls
gnu hardened images
gnu openshift container platform
+1 more

—

Apr 30, 2026

CVE-2026-5263

URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c

URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.

NVD description · AI analysis pending

7.0

<1%

wolfssl wolfssl

—

Apr 9, 2026