#x509

0 stories this week · 6 this month · 9 in 6 months · mostly security

Stories per day · 30 days

8 stories, newest first · one card per story

The visible post says interest is limited and leaves open whether other mail apps inherit the NSS trust store.

Rebuilt Go programs reject chains through the keys, with no disable switch, and older unsupported releases get no fix.

Multiple TLS libraries bypass X.509 name-constraint checks, tracked in four CVEs and three CERT/CC notes.

CERT/CC says TLS libraries inconsistently enforce Name Constraints, with three assigned CVEs already fixed.

CERT/CC warns TLS libraries inconsistently enforce X.509 name constraints, with fixes for GnuTLS and pyca/cryptography.

GBHackersSep 29, 2026high

wolfSSL 5.9.4 fixes 11 TLS and certificate-validation flaws, including trusted-peer and OCSP authentication bypasses.

4 min readwolfssl tls

GPG exploitation talk author clarifies a format-string 0day enabling code execution via printf %n writes and a polyglot PEM certificate payload.

GnuPG's Werner Koch says gpg.fail samples only crash GnuPG via DER-as-printf format string in --debug x509; RCE claim remains unproven.

Stories tagged #x509