CLEANSTART-2026-YR44082 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

CVE-2025-58187 affects multiple packages. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. See references for individual vulnerability details...

CVE-2022-3602

CVE−2022-3602 What is this? This document and repository is a write-up of CVE−2022-3602, a punycode buffer overflow issue in OpenSSL. It's an "anti-POC" the issue does not appear to exploitable intended for folks who maintain their own OpenSSL builds and for compiler maintainers. There is a...

CLEANSTART-2026-MX98420 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

CVE-2025-58187 affects multiple packages. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. See references for individual vulnerability details...

CLEANSTART-2026-LT81386 certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain

Security vulnerability affects the argo-workflows package. A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain...

CLEANSTART-2026-FI57106 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

CVE-2025-58187 affects multiple packages. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. See references for individual vulnerability details...

CLEANSTART-2026-FY51880 certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain

Security vulnerability affects the argo-workflows package. A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain...

K000163776: GnuTLS vulnerability CVE-2026-42011

Security Advisory Description A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities CAs only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint...

CLEANSTART-2026-TT67272 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

Security vulnerability affects the nfs-subdir-external-provisioner package. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate...

PT-2026-122829

Security vulnerability affects the nfs-subdir-external-provisioner package. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate...

netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement

A flaw was found in Netty. Netty's DNS Domain Name System codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the...

netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement

A flaw was found in Netty. Netty's DNS Domain Name System codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the...

EUVD-2026-91228

Improper certificate validation in the directoryName name-constraint check PkixNameConstraintValidator.WithinDNSubtree in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can have certificates issued by, a name-constrained intermediate CA to get...

CVE-2026-63576 URI name constraints checked against a mis-parsed host

Improper certificate validation in PkixNameConstraintValidator ExtractHostFromURL in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or...

EUVD-2026-91227

Improper certificate validation in PkixNameConstraintValidator ExtractHostFromURL in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA, to bypass permitted or...

CLEANSTART-2026-UM83284 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

Security vulnerability affects the cri-tools package. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate...

CLEANSTART-2026-MQ17226 certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain

Security vulnerability affects the cri-tools package. A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain...

AlmaLinux 9.2 [TuxCare] Security Update: golang / golang-bin / golang-docs / golang-misc / golang-race / etc (ALMALINUX9.2:CLSA-2025:1748945500)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1748945500 advisory. - A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the...

CLEANSTART-2026-UA69127 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

Security vulnerability affects the buildkitd package. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate...

Security Bulletin: Storage Virtualize Ansible Collection is VEX affected by a vulnerability in the crypography package

Summary Storage Virtualize Ansible Collection uses the cryptography package to establish secure communications with managed systems. Due to CVE-2026-34073, certificate validation performed by the cryptography package may incorrectly trust certificates in certain DNS name constraint scenarios...

Linux Distros Unpatched Vulnerability : CVE-2026-89134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A certificate with no dNSName SAN but another SAN type present e.g. registeredID or iPAddress bypassed the Subject CN dNSName name-constraint check. The CN-as-D...