https://seclists.org/oss-sec/2026/q4/162: Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595)

Q: Which pyca/cryptography deployments need the available fix?

pyca/cryptography CVE-2026-34073 is fixed in version 46.0.6. The issue involved checking DNS constraints against certificate SANs but not against the requested peer name.

Q: What rustls/webpki version addresses both the wildcard and URI-constraint issues?

For the stable line, upgrade to 0.103.13 to include the wildcard fix and the completed excludedSubtrees handling for URI constraints. Version 0.103.12 introduced the first URI-constraint fix and fixes wildcards under permitted subtrees; the corresponding alpha versions are 0.104.0-alpha.7 and 0.104.0-alpha.6, respectively.

Q: What GnuTLS release contains the reported Name Constraints fix?

GnuTLS CVE-2026-3833 is fixed in version 3.8.13.

Published Oct 14, 2026

Updated

Affected Software

13 affected components

pypi/cryptography<46.0.6

cargo/webpki<0.103.12, >=0.104.0-alpha.0<0.104.0-alpha.6

GNUTLS GNUTLS<3.8.13

wolfSSL wolfssl<5.9.1

AWS AWS-LC<1.71.0

cargo/aws-lc-sys<0.39.0

go crypto/x509<1.26.2

OpenSSL OpenSSL

BoringSSL BoringSSL

Mozilla NSS

LibreSSL LibreSSL

Amazon s2n-tls

Mbed TLS Mbed TLS

Frequently Asked Questions

Which pyca/cryptography deployments need the available fix?

pyca/cryptography CVE-2026-34073 is fixed in version 46.0.6. The issue involved checking DNS constraints against certificate SANs but not against the requested peer name.

What rustls/webpki version addresses both the wildcard and URI-constraint issues?

For the stable line, upgrade to 0.103.13 to include the wildcard fix and the completed excludedSubtrees handling for URI constraints. Version 0.103.12 introduced the first URI-constraint fix and fixes wildcards under permitted subtrees; the corresponding alpha versions are 0.104.0-alpha.7 and 0.104.0-alpha.6, respectively.

What GnuTLS release contains the reported Name Constraints fix?

GnuTLS CVE-2026-3833 is fixed in version 3.8.13.

https://seclists.org/oss-sec/2026/q4/162: Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595)

Affected Software

Frequently Asked Questions

Which pyca/cryptography deployments need the available fix?

What rustls/webpki version addresses both the wildcard and URI-constraint issues?

What GnuTLS release contains the reported Name Constraints fix?

Company

Resources

Contact

Frequently Asked Questions

Which pyca/cryptography deployments need the available fix?

What rustls/webpki version addresses both the wildcard and URI-constraint issues?

What GnuTLS release contains the reported Name Constraints fix?