PT-2026-46040 · Hackage · Crypto/X509+3
Published
2026-06-03
·
Updated
2026-06-03
·
CVE-2026-9648
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
crypton-x509-validation and crypton-x509 do not enforce X.509 Name Constraints
The
crypton-x509-validation and crypton-x509 libraries did not
enforce the X.509 Name Constraints extension during certificate
validation. The Name Constraints extension is a critical X.509
extension that restricts the namespace (permitted and excluded
subtrees) for which a CA is authorized to issue certificates.Without this enforcement, a TLS client would accept certificates with
Subject Alternative Names (SANs) that fall outside the issuing CA's
permitted subtrees. An attacker with access to a name-constrained
sub-CA's private key could therefore issue certificates for domains
outside the sub-CA's intended scope, enabling impersonation of
arbitrary domains and man-in-the-middle attacks on TLS connections.
The older
x509 and x509-validation packages are also affected but
are no longer maintained and have no fix available.This issue was fixed in
crypton-x509-validation-1.9.1 and
crypton-x509-1.9.1. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Crypto/X509
Crypton-X509-Validation
X509
X509-Validation