https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:07:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326655 EUVD-2026-326655 https://cve.radiocsirt.org/vuln/euvd-2026-326655 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9648 <p>The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.</p> <p>The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9648 https://cve.radiocsirt.org/vuln/ghsa-7jx5-vvgh-vcjw <p>The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.</p> <p>The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.</p> https://cve.radiocsirt.org/vuln/ghsa-7jx5-vvgh-vcjw https://cve.radiocsirt.org/vuln/hsec-2026-0008 <p><strong>Affected:</strong> Hackage: crypton-x509-validation, Hackage: crypton-x509, Hackage: x509-validation, Hackage: x509</p> <p># crypton-x509-validation and crypton-x509 do not enforce X.509 Name Constraints</p> <p>The `crypton-x509-validation` and `crypton-x509` libraries did not enforce the X.509 Name Constraints extension during certificate validation. The Name Constraints extension is a critical X.509 extension that restricts the namespace (permitted and excluded subtrees) for which a CA is authorized to issue certificates.</p> <p>Without this enforcement, a TLS client would accept certificates with Subject Alternative Names (SANs) that fall outside the issuing CA&#39;s permitted subtrees. An attacker with access to a name-constrained sub-CA&#39;s private key could therefore issue certificates for domains outside the sub-CA&#39;s intended scope, enabling impersonation of arbitrary domains and man-in-the-middle attacks on TLS connections.</p> <p>The older `x509` and `x509-validation` packages are also affected but are no longer maintained and have no fix available.</p> <p>This issue was fixed in `crypton-x509-validation-1.9.1` and `crypton-x509-1.9.1`.</p> <p><strong>Affected:</strong> Hackage: crypton-x509-validation, Hackage: crypton-x509, Hackage: x509-validation, Hackage: x509</p> <p># crypton-x509-validation and crypton-x509 do not enforce X.509 Name Constraints</p> <p>The `crypton-x509-validation` and `crypton-x509` libraries did not enforce the X.509 Name Constraints extension during certificate validation. The Name Constraints extension is a critical X.509 extension that restricts the namespace (permitted and excluded subtrees) for which a CA is authorized to issue certificates.</p> <p>Without this enforcement, a TLS client would accept certificates with Subject Alternative Names (SANs) that fall outside the issuing CA&#39;s permitted subtrees. An attacker with access to a name-constrained sub-CA&#39;s private key could therefore issue certificates for domains outside the sub-CA&#39;s intended scope, enabling impersonation of arbitrary domains and man-in-the-middle attacks on TLS connections.</p> <p>The older `x509` and `x509-validation` packages are also affected but are no longer maintained and have no fix available.</p> <p>This issue was fixed in `crypton-x509-validation-1.9.1` and `crypton-x509-1.9.1`.</p> https://cve.radiocsirt.org/vuln/hsec-2026-0008 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11077-1 <p>ghc-aws-0.25.2-1.1 on GA media</p> <p>ghc-aws-0.25.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11077-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9648 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: haskell-crypton-x509-validation, Ubuntu:25.10: haskell-crypton-x509-validation, Ubuntu:26.04:LTS: haskell-crypton-x509-validation</p> <p>The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: haskell-crypton-x509-validation, Ubuntu:25.10: haskell-crypton-x509-validation, Ubuntu:26.04:LTS: haskell-crypton-x509-validation</p> <p>The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9648