The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.

The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.

Affected: Hackage: crypton-x509-validation, Hackage: crypton-x509, Hackage: x509-validation, Hackage: x509

# crypton-x509-validation and crypton-x509 do not enforce X.509 Name Constraints

The `crypton-x509-validation` and `crypton-x509` libraries did not enforce the X.509 Name Constraints extension during certificate validation. The Name Constraints extension is a critical X.509 extension that restricts the namespace (permitted and excluded subtrees) for which a CA is authorized to issue certificates.

Without this enforcement, a TLS client would accept certificates with Subject Alternative Names (SANs) that fall outside the issuing CA's permitted subtrees. An attacker with access to a name-constrained sub-CA's private key could therefore issue certificates for domains outside the sub-CA's intended scope, enabling impersonation of arbitrary domains and man-in-the-middle attacks on TLS connections.

The older `x509` and `x509-validation` packages are also affected but are no longer maintained and have no fix available.

This issue was fixed in `crypton-x509-validation-1.9.1` and `crypton-x509-1.9.1`.

ghc-aws-0.25.2-1.1 on GA media

Affected: Ubuntu:24.04:LTS: haskell-crypton-x509-validation, Ubuntu:25.10: haskell-crypton-x509-validation, Ubuntu:26.04:LTS: haskell-crypton-x509-validation

The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.