CLEANSTART-2026-QO20135 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

🗓️ 15 Apr 2026 00:44:38Reported by GoogleType

osv🔗 osv.dev👁 17 Views

Certificate chain verification fails for wildcard DNS SANs due to case mismatch in constraints, affecting minio-operator-fips.

Reporter	Title	Published	Views	Family All 11341
OSV	MINI-9FQX-4H56-W24H	23 Mar 202604:47	–	osv
OSV	MINI-9FR3-9QQR-94GJ	11 Apr 202614:47	–	osv
OSV	MINI-9FV7-V84P-4M4H	13 Mar 202613:07	–	osv
OSV	MINI-9FVG-RQXG-49WH	4 Mar 202605:26	–	osv
OSV	MINI-9FXJ-W523-RP3Q	13 Mar 202607:57	–	osv
OSV	MINI-9G2M-MXJ3-G43J	12 Apr 202620:17	–	osv
OSV	MINI-9G42-G97R-7QPV	4 Mar 202605:26	–	osv
OSV	MINI-9G4Q-RX54-2R4R	11 Apr 202621:02	–	osv
OSV	MINI-9G4V-2G3W-JGPW	4 Mar 202605:28	–	osv
OSV	MINI-9G58-QC55-W73J	4 Mar 202605:26	–	osv

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-QO20135.json
osv	www.osv.dev/vulnerability/CVE-2025-61726
osv	www.osv.dev/vulnerability/CVE-2025-61728
osv	www.osv.dev/vulnerability/CVE-2025-61730
osv	www.osv.dev/vulnerability/CVE-2025-61732
osv	www.osv.dev/vulnerability/CVE-2025-68119
osv	www.osv.dev/vulnerability/CVE-2025-68121
osv	www.osv.dev/vulnerability/CVE-2026-25679
osv	www.osv.dev/vulnerability/CVE-2026-27139
osv	www.osv.dev/vulnerability/CVE-2026-27142

21 May 2026 10:30Current

7.2High risk

Vulners AI Score7.2

CVSS 3.19.8

EPSS0.01945