Loading story…
CERT/CC disclosed CVE-2026-9648 in the Haskell library crypton-x509-validation, warning that affected TLS clients may accept certificates that violate X.509 NameConstraints. The flaw stems from the library not enforcing the RFC 5280 safeguard, which can let an attacker who has compromised a name-constrained subordinate CA create certificates for domains outside the CA’s authorized scope and use them in malicious TLS interception.
The vulnerability carries a CVSS 9.1 rating and can expose organizations to credential theft, secret theft, and disclosure of sensitive financial data, particularly in delegated PKI environments such as banks, insurers, and large enterprises. All prior versions are affected, and the issue has been fixed in crypton-x509-validation 1.9.1; maintainers and CERT/CC urged Haskell teams to upgrade immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The vulnerability, tracked as CVE-2026-9648, was fixed in crypton-x509-validation version 1.9.1. Prior versions were reported as affected.
CERT/CC published vulnerability note VU#862559 warning that Haskell crypton-x509-validation libraries do not enforce X.509 NameConstraints, enabling improper certificate validation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Go disclosed **CVE-2026-33810**, a certificate validation flaw in `crypto/x509` in Go 1.26 that can cause excluded DNS name constraints to be enforced incorrectly for wildcard Subject Alternative Names. The bug appears when a wildcard SAN such as `*.example.com` is evaluated against an excluded constraint written with different letter casing, such as `EXAMPLE.COM`, allowing the wildcard domain to bypass the exclusion during certificate chain verification. The issue affects otherwise trusted certificate chains anchored in `VerifyOptions.Roots` or the system certificate pool, narrowing exposure to chains that already terminate at a trusted root CA. Go tracked the bug as issue **#78332**, credited the report to Riyas from Saintgits College of Engineering, k1rnt, and @1seal, and later published a fix on the `release-branch.go1.26`; downstream vendors including SUSE also opened advisories for the vulnerability.
Jun 29, 2026
Academic researchers disclosed a fundamental weakness in **attested TLS**, the remote attestation mechanism used by confidential computing platforms to prove a server is running inside a trusted execution environment (**TEE**). The team, led by Muhammad Usama Sardar of TU Dresden, found that current intra-handshake attestation designs do not securely bind attestation evidence to the actual TLS connection, enabling relay or diversion attacks in which a client validates a genuine attested server or AI agent but unknowingly sends encrypted traffic to a different malicious machine. The issue has been assigned **`CVE-2026-33697`** and rated high severity. The researchers formally analyzed seven cryptographic binding approaches and reported that none prevented this attack class, raising concerns that stronger “level-three” binding may be unattainable within the current architecture. Reported affected implementations include **Meta’s Private Processing for WhatsApp**, **Edgeless Systems’ Contrast**, **Cocos AI**, and a **Confidential Computing Consortium** proof of concept. Standards groups including the **IETF SEAT** and **TLS** working groups have acknowledged the findings, while the researchers recommended moving away from intra-handshake attestation toward **post-handshake attestation** as a safer alternative.
Jul 12, 2026
A newly disclosed vulnerability, **CVE-2026-5194**, affects wolfSSL and can cause ECDSA certificate verification routines to accept digests smaller than required because hash/digest size and OID checks are missing. The flaw is classified as `CWE-295` and weakens certificate-based authentication by reducing the assurance that an ECDSA signature was validated against the proper digest constraints. The issue impacts ECDSA/ECC verification in wolfSSL configurations where **EdDSA** or **ML-DSA** is also enabled, and the risk is greater when the public CA key is known. Public references point to a wolfSSL GitHub pull request as well as MITRE and NVD tracking, while severity data published by Tenable includes CVSS v2, v3, and v4 scoring that describes a network-reachable issue with significant confidentiality and integrity impact in newer versions.
Jun 30, 2026