{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/948176#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nThis note covers thirteen library-specific records (VU#948176.6, .8–.19) of how widely used TLS libraries apply X.509 Name Constraints. The records describe cases where a constrained name may be accepted by one library and rejected by another. Some are fixed, some remain under review, and some were not accepted as security issues.\r\n\r\n### Description\r\nName Constraints are meant to keep a subordinate CA inside an allowed namespace. The records cover several name forms and do not all have the same classification. VU#948176.7 does not exist.\r\n\r\n**DNS case-sensitivity and wildcards.** While RFC 5280 requires case-insensitive DNS matching, it does not explicitly define wildcard Subject Alternative Name (SAN) matching, leading to varied implementation behaviors. For instance, GnuTLS was found to perform case-sensitive comparisons on certain names (CVE-2026-3833, fixed in 3.8.13). Similar discrepancies regarding case handling in wildcard parent-constraint lookups were reported in Go, as well as wildcard inconsistencies in LibreSSL and wolfSSL. Additionally, pyca/cryptography was identified to check DNS Name Constraints against certificate SANs but failed to validate them against the requested peer name (CVE-2026-34073, fixed in 46.0.6).\r\n\r\n**IP addresses.** Some libraries treat IPv4 and IPv4-mapped IPv6 forms as different when matching constraints. The Go security team determined that report did not meet its security bar; similar reports exist for Apple's Security.framework and Mozilla NSS and are included as comparative evidence.\r\n\r\n**URIs.** Libraries can differ on which host they extract from a URI SAN. OpenSSL merged [PR #30319](https://github.com/openssl/openssl/pull/30319) for an `@` in the path, query, or fragment; a separate userinfo-colon report remains in triage. Related URI reports exist for Apple, NSS, and wolfSSL (CVE-2026-3547, fixed in 5.9.0). A well-formed single `@` is handled per RFC 3986 by most implementations.\r\n\r\n**Common Name fallback.** AWS-LC and s2n-tls were reported to apply DNS constraints inconsistently when a leaf has no SAN and uses a wildcard Common Name. The AWS-LC wildcard-CN issue has been fixed; a separate Unicode CN question remains under coordination. s2n-tls is in triage.\r\n\r\n**Non-critical constraints.** In the reported Mbed TLS configuration, non-critical Name Constraints are not enforced. RFC 5280 requires conforming CAs to mark the extension critical, and the reviewed Mbed TLS 3.x configuration rejects unsupported critical extensions. The vendor treats adding support as a feature request; the reporter's concern remains disputed.\r\n\r\n### Impact\r\nThese records matter only when an attacker can obtain a trusted signature over chosen certificate fields, reach an affected validation path, and the application uses the accepted identity for authorization. Validator disagreement alone is not exploitation. Effects, if any, are deployment-specific and may include acceptance of a name outside the intended namespace.\r\n\r\n### Solution\r\nCERT/CC is coordinating remediation across the affected projects. The following summarizes available status; individual entries reflect different reporting and confirmation dates.\r\n\r\n**GnuTLS** — CVE-2026-3833 fixed in 3.8.13.\r\n\r\n**`pyca/cryptography`** — CVE-2026-34073 fixed in 46.0.6.\r\n\r\n**wolfSSL** — CVE-2026-3547 fixed in 5.9.0. The wildcard was addressed in [PR# 9991](https://github.com/wolfssl/wolfssl/pull/9991).\r\n\r\n**Go's `crypto/x509`** — Two reports are in triage. The IPv4-mapped IPv6 report was not accepted as meeting the project's security bar.\r\n\r\n**OpenSSL** — PR #30319 was merged and, as confirmed on 10 September 2026, is present in all then-current publicly supported versions. The separate userinfo-colon report remains in triage.\r\n\r\n**Apple's `Security.framework`** — Three reports submitted on 2026-03-16 remain in triage.\r\n\r\n**Mozilla NSS** — IP-address report under coordination.\r\n\r\n**LibreSSL** — Wildcard report under coordination.\r\n\r\n**AWS-LC** — Wildcard CN issue fixed; Unicode CN report under coordination. **s2n-tls** is in triage.\r\n\r\n**Mbed TLS** — Non-critical Name Constraints are not enforced in the reported configuration. Marking the extension critical causes such chains to fail closed rather than adding enforcement.\r\n\r\nUntil updates are widely deployed, operators who depend on Name Constraints should confirm the behavior of the libraries they actually run, keep leaf certificates to explicit SANs, and treat issuance policy as the first control. A second validator helps only when it uses the same inputs and fails closed.\r\n\r\n### Acknowledgements\r\nThanks to Oleh Konko for discovering and reporting these issues. This document was prepared with AI assistance by Timur Snoke.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/948176"}],"title":"Multiple TLS Libraries can Bypass Delegation Enforcement","tracking":{"current_release_date":"2026-10-14T15:11:20+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.50"}},"id":"VU#948176","initial_release_date":"2026-10-14 15:11:20.199107+00:00","revision_history":[{"date":"2026-10-14T15:11:20+00:00","number":"1.20261014151120.1","summary":"Released on 2026-10-14T15:11:20+00:00"}],"status":"final","version":"1.20261014151120.1"}},"vulnerabilities":[{"title":"Name constraint bypass in excluded dNSName/rfc822Name subtree matching in a CA certificate validation library (GnuTLS) allows an attacker with a certificate from a Name-Constrained intermediate CA to bypass DNS name or email address restrictions via a name with mismatched case (e.","notes":[{"category":"summary","text":"Name constraint bypass in excluded dNSName/rfc822Name subtree matching in a CA certificate validation library (GnuTLS) allows an attacker with a certificate from a Name-Constrained intermediate CA to bypass DNS name or email address restrictions via a name with mismatched case (e.g., Evil.EXCLUDED.example.com)."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint bypass in wildcard subtree comparison in a downstream cryptography library (pyca) allows an attacker with a certificate from a constrained intermediate CA to bypass wildcard-based exclusions via a wildcard SAN or wildcard in excluded subtree that isn't expanded correctly.","notes":[{"category":"summary","text":"Name constraint bypass in wildcard subtree comparison in a downstream cryptography library (pyca) allows an attacker with a certificate from a constrained intermediate CA to bypass wildcard-based exclusions via a wildcard SAN or wildcard in excluded subtree that isn't expanded correctly."}],"cve":"CVE-2026-34073","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint bypass in wildcard subtree comparison in a CA certificate validation library (wolfSSL) allows an attacker with a certificate from a constrained intermediate CA to bypass wildcard-based exclusions via a wildcard SAN or wildcard in excluded subtree that isn't expanded correctly.","notes":[{"category":"summary","text":"Name constraint bypass in wildcard subtree comparison in a CA certificate validation library (wolfSSL) allows an attacker with a certificate from a constrained intermediate CA to bypass wildcard-based exclusions via a wildcard SAN or wildcard in excluded subtree that isn't expanded correctly."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint bypass in excluded dNSName subtree matching in a CA certificate validation library (Go) allows an attacker with a certificate from a constrained intermediate CA to bypass wildcard DNS name restrictions via a wildcard SAN (e.","notes":[{"category":"summary","text":"Name constraint bypass in excluded dNSName subtree matching in a CA certificate validation library (Go) allows an attacker with a certificate from a constrained intermediate CA to bypass wildcard DNS name restrictions via a wildcard SAN (e.g., *.excluded.example.com) where parentConstraints map lookup is case-sensitive."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint bypass in Common Name fallback logic in a CA certificate validation library (AWS-LC) allows an attacker with a certificate from a constrained intermediate CA to bypass dNSName constraints via a leaf certificate with no SAN and a wildcard Common Name (e.","notes":[{"category":"summary","text":"Name constraint bypass in Common Name fallback logic in a CA certificate validation library (AWS-LC) allows an attacker with a certificate from a constrained intermediate CA to bypass dNSName constraints via a leaf certificate with no SAN and a wildcard Common Name (e.g., *.excluded.example.com)."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint bypass in Common Name fallback logic in a server TLS stack (AWS s2n-tls) allows an attacker with a certificate from a constrained intermediate CA to bypass dNSName constraints via a leaf certificate with no SAN and a wildcard Common Name (e.","notes":[{"category":"summary","text":"Name constraint bypass in Common Name fallback logic in a server TLS stack (AWS s2n-tls) allows an attacker with a certificate from a constrained intermediate CA to bypass dNSName constraints via a leaf certificate with no SAN and a wildcard Common Name (e.g., *.excluded.example.com)."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"IPAddress validation in Mozilla NSS relies on incorrect raw DER family and length matching instead of canonical endpoint identity comparison, which allows remote unauthenticated attackers to bypass certificate name constraints and obtain fraudulent certificates for internal IPv6 addresses via a certificate containing an IPv4-mapped IPv6 address in the SAN.","notes":[{"category":"summary","text":"IPAddress validation in Mozilla NSS relies on incorrect raw DER family and length matching instead of canonical endpoint identity comparison, which allows remote unauthenticated attackers to bypass certificate name constraints and obtain fraudulent certificates for internal IPv6 addresses via a certificate containing an IPv4-mapped IPv6 address in the SAN."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint enforcement missing in certificate path validation in an embedded TLS library (Mbed TLS) allows an attacker with any certificate to bypass all Name Constraints via a certificate issued by an intentionally constrained intermediate CA.","notes":[{"category":"summary","text":"Name constraint enforcement missing in certificate path validation in an embedded TLS library (Mbed TLS) allows an attacker with any certificate to bypass all Name Constraints via a certificate issued by an intentionally constrained intermediate CA."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint bypass in URI authority parsing in a CA certificate validation library (OpenSSL) allows an attacker with a certificate from a constrained intermediate CA to bypass URI-based constraints via a URI authority with userinfo and colon (e.","notes":[{"category":"summary","text":"Name constraint bypass in URI authority parsing in a CA certificate validation library (OpenSSL) allows an attacker with a certificate from a constrained intermediate CA to bypass URI-based constraints via a URI authority with userinfo and colon (e.g., https://user:pass@evil.com:443@constrained.example.com/)."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint bypass in iPAddress name constraint checking in a mobile OS certificate trust framework (macOS 26.","notes":[{"category":"summary","text":"Name constraint bypass in iPAddress name constraint checking in a mobile OS certificate trust framework (macOS 26.3.1 arm64) allows an attacker with a certificate from a constrained intermediate CA to bypass IP range restrictions via an IPv4-mapped IPv6 address (e.g., ::ffff:10.0.0.1) in a SAN when the NC excludes the IPv4 range 10.0.0.0/8."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint bypass in URI host extraction in a mobile OS certificate trust framework (macOS 26.","notes":[{"category":"summary","text":"Name constraint bypass in URI host extraction in a mobile OS certificate trust framework (macOS 26.3.1 arm64) allows an attacker with a certificate from a constrained intermediate CA to bypass URI-based constraints via a URI with userinfo (e.g., https://evil@constrained.example.com/) where the host is miscomputed."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint bypass in URI host extraction in a CA certificate validation library (OpenSSL) allows an attacker with a certificate from a constrained intermediate CA to bypass URI-based constraints via a URI authority with userinfo and colon (e.","notes":[{"category":"summary","text":"Name constraint bypass in URI host extraction in a CA certificate validation library (OpenSSL) allows an attacker with a certificate from a constrained intermediate CA to bypass URI-based constraints via a URI authority with userinfo and colon (e.g., https://user:pass@evil.com:443@constrained.example.com/)."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint bypass in wildcard subtree comparison in a CA certificate validation library (LibreSSL) allows an attacker with a certificate from a constrained intermediate CA to bypass wildcard-based exclusions via a wildcard SAN or wildcard in excluded subtree that isn't expanded correctly.","notes":[{"category":"summary","text":"Name constraint bypass in wildcard subtree comparison in a CA certificate validation library (LibreSSL) allows an attacker with a certificate from a constrained intermediate CA to bypass wildcard-based exclusions via a wildcard SAN or wildcard in excluded subtree that isn't expanded correctly."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]},{"title":"Name constraint bypass in iPAddress name constraint checking in a CA certificate validation library (Go) allows an attacker with a certificate from a constrained intermediate CA to bypass IP range restrictions via an IPv4-mapped IPv6 address (e.","notes":[{"category":"summary","text":"Name constraint bypass in iPAddress name constraint checking in a CA certificate validation library (Go) allows an attacker with a certificate from a constrained intermediate CA to bypass IP range restrictions via an IPv4-mapped IPv6 address (e.g., ::ffff:10.0.0.1) when the NC excludes 10.0.0.0/8."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#948176"}]}],"product_tree":{"branches":[]}}