CVE-2025-61727 — Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomai…
Published: 2025-12-03 · CVSS: 6.5 · CVSS 3.1
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7