Skip to content
TLS Libraries Vulnerabilities Affect Name Constraints Enforcement

TLS Libraries Vulnerabilities Affect Name Constraints Enforcement

First seen 14 Oct 2026, 20:37 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 21:33 UTC
  • •Multiple TLS libraries show inconsistent enforcement of X.509 Name Constraints.
  • •Notable CVEs include CVE-2026-3833, CVE-2026-3547, and CVE-2026-34073.
  • •CERT/CC is coordinating remediation efforts across affected libraries.

Multiple TLS libraries have been found to inconsistently enforce X.509 Name Constraints, leading to potential security risks. Libraries such as GnuTLS, Go, OpenSSL, and pyca/cryptography exhibit varying behaviors in DNS name comparison, IP address handling, and URI parsing. Notable CVEs include CVE-2026-3833, CVE-2026-3547, and CVE-2026-34073, with some vulnerabilities already patched. The discrepancies may allow attackers to exploit accepted identities for authorization if they can obtain a trusted signature over chosen certificate fields. CERT/CC is coordinating remediation efforts across affected projects. The impact is deployment-specific, and organizations are advised to test their validators against their specific requirements.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-03-19
CVE-2026-3547 published
A vulnerability in OpenSSL related to URI parsing was disclosed, affecting multiple libraries.
Kb.Cert
2026-03-31
CVE-2026-34073 published
pyca/cryptography was found to improperly validate DNS Name Constraints against peer names.
Kb.Cert
2026-04-30
CVE-2026-3833 published
GnuTLS was reported to perform case-sensitive comparisons on DNS names, leading to potential vulnerabilities.
Kb.Cert
2026-10-14
Latest advisory published
CERT/CC released a note summarizing the vulnerabilities and ongoing remediation efforts across affected libraries.
Kb.Cert

More articles in this cluster (4)

Following this threat?

Track Apple and CVE-2026-34073 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 2

Common questions

Which TLS libraries are affected?
Affected libraries include GnuTLS, Go, OpenSSL, pyca/cryptography, LibreSSL, and wolfSSL.
What should organizations do to mitigate risks?
Organizations should test their validators against deployment requirements and apply available updates.
Are there known exploits in the wild?
No confirmed exploitation has been reported for these vulnerabilities as of now.