VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic
Imported from official source
Five Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, and one was declined. Name Constraints limit the names a subordinate certificate authority may issue. …
This version
- Version
- 1 of 2
- Recorded
- October 14, 2026 16:00
- Change
- Initial
- Content hash
dbe5937ac85fcbf7cac66b2c2e6060dd- All versions
- Revision history