CLEANSTART-2026-IG94553 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

🗓️ 25 Feb 2026 00:49:42Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Helm-fips package vulnerabilities reveal a subdomain constraint flaw that allows wildcard subject alt name in leaf certificate.

Reporter	Title	Published	Views	Family All 7010
Wolfi	CVE-2025-58183 vulnerabilities	2 Nov 202514:17	–	wolfi
Wolfi	CVE-2025-58185 vulnerabilities	2 Nov 202514:17	–	wolfi
Wolfi	CVE-2025-58187 vulnerabilities	2 Nov 202514:17	–	wolfi
Wolfi	CVE-2025-58188 vulnerabilities	2 Nov 202514:17	–	wolfi
Wolfi	CVE-2025-58189 vulnerabilities	2 Nov 202514:17	–	wolfi
Wolfi	CVE-2025-61723 vulnerabilities	2 Nov 202514:17	–	wolfi
Wolfi	CVE-2025-61724 vulnerabilities	2 Nov 202514:17	–	wolfi
Wolfi	CVE-2025-61725 vulnerabilities	2 Nov 202514:17	–	wolfi
Wolfi	CVE-2025-61727 vulnerabilities	7 Dec 202519:47	–	wolfi
Wolfi	CVE-2025-61729 vulnerabilities	4 Dec 202519:47	–	wolfi

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IG94553
osv	www.osv.dev/vulnerability/CVE-2025-58183
osv	www.osv.dev/vulnerability/CVE-2025-58185
osv	www.osv.dev/vulnerability/CVE-2025-58187
osv	www.osv.dev/vulnerability/CVE-2025-58188
osv	www.osv.dev/vulnerability/CVE-2025-58189
osv	www.osv.dev/vulnerability/CVE-2025-61723
osv	www.osv.dev/vulnerability/CVE-2025-61724
osv	www.osv.dev/vulnerability/CVE-2025-61725
osv	www.osv.dev/vulnerability/CVE-2025-61727

02 Apr 2026 13:31Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

EPSS0.00617