Security Bulletin:Improper Certificate Validation in Erlang OTP public_key: DNS NameConstraints Bypass in TLS Hostname Verification

Summary Improper Certificate Validation vulnerability in Erlang OTP publickey pubkeycert and publickey modules allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted e.g...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted...

CentOS Linux 8.5 [TuxCare] Security Update: gnutls / gnutls-c++ / gnutls-dane / gnutls-devel / gnutls-utils (CENTOS8.5:CLSA-2026:1778835563)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1778835563 advisory. - A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels,...

AlmaLinux 9.2 [TuxCare] Security Update: gnutls / gnutls-c++ / gnutls-dane / gnutls-devel / gnutls-utils (ALMALINUX9.2:CLSA-2026:1779963183)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779963183 advisory. - A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels,...

Rocky Linux 9.6 [TuxCare] Security Update: gnutls / gnutls-c++ / gnutls-dane / gnutls-devel / gnutls-utils (ALMALINUX9.6:CLSA-2026:1779827686)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779827686 advisory. - A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels,...

AlmaLinux 9.6 [TuxCare] Security Update: gnutls / gnutls-c++ / gnutls-dane / gnutls-devel / gnutls-utils (ALMALINUX9.6:CLSA-2026:1779827686)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779827686 advisory. - A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels,...

CentOS Linux 8 [TuxCare] Security Update: gnutls / gnutls-c++ / gnutls-dane / gnutls-devel / gnutls-utils (CENTOS-STREAM8:CLSA-2026:1779120390)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1779120390 advisory. - A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels,...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in gnutls

Summary IBM DataPower Gateway has addressed multiple vulnerabilities in gnutls in version 11.0.0.3 Vulnerability Details CVEID:CVE-2026-3832 DESCRIPTION: A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status...

Linux Distros Unpatched Vulnerability : CVE-2026-89133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when...

CVE-2026-89133

wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted...

AZL-105176 CVE-2026-89133 affecting package mariadb 10.11.19-1

wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted...

DEBIAN-CVE-2026-89133

wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted...

CVE-2026-89133

wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted...