CERT/CC Coordinates Name-Constraint Differences Across TLS Libraries
Tech GuruQuick Answer
CERT/CC published VU#948176 for GnuTLS, pyca/cryptography, wolfSSL, Go crypto/x509, OpenSSL, Apple Security.framework, Mozilla NSS, LibreSSL, AWS-LC, s2n-tls, and Mbed TLS. CERT/CC described inconsistent X.509 Name Constraints handling across multiple TLS libraries and separated fixed, triaged, rejected, and disputed records. Match the exact preconditions, follow the record-specific remediation, validate affected workflows, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory the TLS libraries and versions actually used for authorization, map each deployment to the record-specific status, deploy the applicable project or product fix, and test constrained certificate chains and fail-closed behavior.
Last verified: 2026-10-15 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | GnuTLS, pyca/cryptography, wolfSSL, Go crypto/x509, OpenSSL, Apple Security.framework, Mozilla NSS, LibreSSL, AWS-LC, s2n-tls, and Mbed TLS |
|---|---|
| Advisory | VU#948176 |
| CVEs | CVE-2026-34073, CVE-2026-3547, CVE-2026-3833 |
| Authoritative release date | 2026-10-14 00:00:00 UTC |
| Authority revision date | 2026-10-15 12:24:00 UTC |
| Affected versions | Thirteen library-specific records with different affected paths, name forms, and statuses; exposure requires a trusted signature over chosen certificate fields and authorization that relies on the accepted identity. |
| Fixed version | GnuTLS 3.8.13, pyca/cryptography 46.0.6, wolfSSL 5.9.0, and project-specific fixes or coordination states listed in VU#948176 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CERT/CC described inconsistent X.509 Name Constraints handling across multiple TLS libraries and separated fixed, triaged, rejected, and disputed records.
What To Validate Now
- Inventory. Locate GnuTLS, pyca/cryptography, wolfSSL, Go crypto/x509, OpenSSL, Apple Security.framework, Mozilla NSS, LibreSSL, AWS-LC, s2n-tls, and Mbed TLS deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Thirteen library-specific records with different affected paths, name forms, and statuses; exposure requires a trusted signature over chosen certificate fields and authorization that relies on the accepted identity. Do not infer applicability from product family or severity alone.
- Remediate. Apply GnuTLS 3.8.13, pyca/cryptography 46.0.6, wolfSSL 5.9.0, and project-specific fixes or coordination states listed in VU#948176 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Validator disagreement alone is not exploitation. The records have different statuses and preconditions; do not apply one library's version statement or outcome to another implementation. Preserve the authority snapshot, asset and owner records, before-and-after versions, change approval, installation output, validation results, exceptions, and rollback evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
