by Kastro
Paper/Archive/CVE-2026-9648

CVE-2026-9648

Haskell Programming Language crypton-certificate — CVE-2026-9648

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
30
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 12.9.129 × 202.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.

Affected

ProductAffectedFixed inSource
crypton-certificate< 1.9.11.9.1CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/kazu-yamamoto/crypton-certificate/pull/30refgithub.com/kazu-yamamoto/crypton-certificate/pull/30/changes/f4b77edf6ead77f4a886da40e41eab20f0180e39refhackage.haskell.org/package/crypton-x509-validation-1.9.1/revisionsrefgithub.com/haskell/security-advisories/pull/332refkb.cert.org/vuls/id/862559