Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595)

As cited

Copy frozen at 2026-10-14 21:05 UTC (site build).

vulnerabilities

Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595)

CERT/CC published vulnerability notes on October 13 and 14, 2026, documenting enforcement bypasses in multiple open-source TLS and X.509 libraries related to Name Constraints validation under RFC 5280. The issues span four categories affecting DNS-name comparison and related mechanisms across different TLS library implementations.

Why it matters: Organizations using affected TLS libraries face potential bypasses of Name Constraints, which could allow certificate validation to succeed when it should fail; practitioners should check whether their deployments use any of the four affected libraries and review available patches.

Source published

2026-10-14 18:50 UTC

First seen by Cybersecurity Tracker

2026-10-14 19:58 UTC