PT-2026-102299

An excluded subtrees iPAddress name constraint with an all-zero mask 0.0.0.0/0 or ::/0 does not restrict iPAddress SANs in certificates issued beneath it. The mask check treated an all-zero mask as matching nothing, when a /0 prefix matches every address of its family, so the exclusion was silent...