Severity: HighAction: Patch
VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation
Patch
Apply the vendor's security update for the affected products.
Vulnerability record
CVE-2026-34073
Severity: InformationalExploitation: No known exploitation
Patch status
No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.
Description
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
Intelligence timeline
Developments from the last 30 days, newest first.
- CVSS scoredUpdate
CVE-2026-34073 scored CVSS 1.7
Basis: NIST National Vulnerability Database