CERT/CC: VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic
CERT/CC has published a new security advisory. Here is a summary and what to do.
Key points
- New advisory from CERT/CC.
- Review affected versions in the advisory.
- Apply updates promptly.
CERT/CC published a security advisory titled “VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic”.
At a glance
- Publisher
- CERT/CC
- CVEs
- See advisory
What the advisory says
Overview Five Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, and one was declined. Description Name Constraints limit the names a subordinate certificate authority may issue. The reports concern how BoringSSL applies those limits to certain SAN (Subject Alternative Name) forms. The records do not share one status, and they do not all affect the same validation path. VU#410595.8 ( Fixed 2026-03-04 ): A wildcard DNS name may not be treated as covering a specifically excluded host. VU#410595.9 ( Accepted ): A URI with a colon before @ may cause the wrong host to be used when matching URI constraints. VU#410595.10 ( Disputed ): The finding concerns first-@ d
What should you do?
- Read the full vendor advisory linked below and confirm whether you run affected versions.
- Schedule the recommended update, prioritising internet-facing systems.
- Watch for exploitation reports; unpatched edge devices are frequent targets.
What to do and how to stay safe: CERT/CC
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
