Thirteen TLS Flaws Allow Name Constraint Bypass in Major Libraries

CERT/CC published advisory VU#948176 detailing thirteen records of inconsistent X.509 Name Constraint enforcement across widely used TLS libraries. These inconsistencies allow constrained names to be accepted by some validation engines while being rejected by others. The findings affect how subordinate certificate authorities are kept within allowed namespaces. Some reported issues have been patched, while others remain under review or were not accepted as security vulnerabilities by their respective vendors.

Which libraries and vulnerabilities are affected?

The advisory covers discrepancies in GnuTLS, Go, LibreSSL, wolfSSL, pyca/cryptography, OpenSSL, Apple's Security.framework, Mozilla NSS, AWS-LC, s2n-tls, and Mbed TLS. Specific CVEs include CVE-2026-3833 for GnuTLS case-sensitivity, CVE-2026-34073 for pyca/cryptography peer name validation, and CVE-2026-3547 for wolfSSL URI handling. GnuTLS fixed its issue in version 3.8.13, pyca/cryptography in 46.0.6, and wolfSSL in 5.9.0.

What technical behaviors trigger these bypasses?

RFC 5280 requires case-insensitive DNS matching but does not explicitly define wildcard Subject Alternative Name matching, leading to varied implementations. GnuTLS performed case-sensitive comparisons on certain names. pyca/cryptography checked constraints against certificate SANs but failed to validate them against the requested peer name. Some libraries treat IPv4 and IPv4-mapped IPv6 forms as distinct when matching constraints, causing validation disagreements.

How do URI and Common Name issues factor in?

Libraries differ on which host they extract from a URI Subject Alternative Name. OpenSSL merged a fix for an at-sign in the path, query, or fragment, present in all current publicly supported versions as of September 10, 2026. AWS-LC and s2n-tls were reported to apply DNS constraints inconsistently when a leaf certificate lacks a SAN and uses a wildcard Common Name. AWS-LC has fixed its wildcard Common Name issue.

What is the remediation status for remaining reports?

Go's crypto/x509 has two reports in triage, with the IPv4-mapped IPv6 report not accepted as meeting the project's security bar. Apple's Security.framework has three reports submitted on March 16, 2026, remaining in triage. Mozilla NSS has an IP-address report under coordination. LibreSSL has a wildcard report under coordination. Mbed TLS does not enforce non-critical Name Constraints in the reported configuration, which the vendor treats as a feature request.

Detection notes

Security operations teams should monitor certificate validation logs for discrepancies between different library outputs when processing the same certificate chain. Analysts should check for alerts indicating acceptance of certificates with names outside expected namespaces. Teams usually review TLS handshake logs for unusual wildcard patterns or case variations in domain names. Containment moves involve isolating systems using affected library versions and verifying that certificate pinning or strict validation policies are enforced to prevent unauthorized delegation.

What to do and how to stay safe: CVE-2026-3833

• Audit your environment for the specific library versions mentioned in the advisory, such as GnuTLS 3.8.13 or wolfSSL 5.9.0, and apply available patches.
• Once the vendor provides an update, upgrade TLS libraries to versions that address the reported name constraint enforcement issues.
• Review certificate validation configurations to ensure strict adherence to RFC 5280 requirements, particularly regarding case sensitivity and wildcard handling.
• Monitor logs for validation errors or discrepancies between different TLS libraries processing identical certificate chains in your infrastructure.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this mean TLS is broken?

No, CERT/CC states that validator disagreement alone is not exploitation; effects are deployment-specific and require an attacker to obtain a trusted signature over chosen fields.

Are all thirteen records considered high severity?

The records do not all have the same classification; some were not accepted as security issues by their respective vendors, while others were fixed or remain under review.

How can I check if my system is affected?

Check your installed versions of TLS libraries against the fixed versions listed, such as GnuTLS 3.8.13, pyca/cryptography 46.0.6, and wolfSSL 5.9.0.