https://seclists.org/oss-sec/2026/q4/162: Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595)
Published Oct 14, 2026
·Updated
Affected Software
13 affected components
pypi/cryptography<46.0.6
cargo/webpki<0.103.12, >=0.104.0-alpha.0<0.104.0-alpha.6
GNUTLS GNUTLS<3.8.13
wolfSSL wolfssl<5.9.1
AWS AWS-LC<1.71.0
cargo/aws-lc-sys<0.39.0
go crypto/x509<1.26.2
OpenSSL OpenSSL
BoringSSL BoringSSL
Mozilla NSS
LibreSSL LibreSSL
Amazon s2n-tls
Mbed TLS Mbed TLS
Frequently Asked Questions
1
Which pyca/cryptography deployments need the available fix?
pyca/cryptography CVE-2026-34073 is fixed in version 46.0.6. The issue involved checking DNS constraints against certificate SANs but not against the requested peer name.
2
What rustls/webpki version addresses both the wildcard and URI-constraint issues?
For the stable line, upgrade to 0.103.13 to include the wildcard fix and the completed excludedSubtrees handling for URI constraints. Version 0.103.12 introduced the first URI-constraint fix and fixes wildcards under permitted subtrees; the corresponding alpha versions are 0.104.0-alpha.7 and 0.104.0-alpha.6, respectively.
3
What GnuTLS release contains the reported Name Constraints fix?
GnuTLS CVE-2026-3833 is fixed in version 3.8.13.