CVE-2026-96489.1Critical
CVE-2026-9648
Haskell Programming Language · crypton-certificate
Not in CISA KEVVendor fix available
0.2%probability of exploitation in the next 30 days
12th percentile
050100
Higher than 12% of scored CVEs
9.1CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 16 Jun.
- Haskell TLS flaw allows forged certificates, CVE-2026-9648SecurityOnline · first in our coverage
New articles also arrive in the RSS feed.