Haskell TLS stack bypasses X.509 NameConstraints
CVE-2026-9648 allows attackers with compromised sub-CA keys to impersonate any domain in Haskell TLS clients due to missing NameConstraints enforcement.
A critical vulnerability in the Haskell TLS software stack allows attackers to bypass X.509 NameConstraints validation, enabling certificate impersonation attacks. The crypton-x509-validation library fails to enforce RFC 5280 NameConstraints, which restrict which domains a certificate authority can issue certificates for. This allows an attacker who compromises a name-constrained sub-CA to create certificates for domains outside its permitted scope, tricking Haskell clients into accepting them.
The vulnerability is particularly concerning for enterprise, academic, and financial systems that commonly use Haskell for backend services including fraud detection and risk modeling. An attacker exploiting this flaw could set up a malicious web server with a fraudulent certificate, intercept connections from vulnerable Haskell clients, and capture credentials and sensitive data transmitted during the session. Industries using delegated PKI structures, typical in banking and financial sectors, face elevated risk.
Version 1.9.1 of crypton-x509-validation has been released to address the vulnerability. All prior versions are vulnerable and should be updated immediately. While successful exploitation requires considerable setup and victim interaction, the potential impact on financial and enterprise systems warrants urgent patching.
Mentioned in this report
Detection guidance
1 detection artefacts for this report are available to subscribers.
Source reporting: https://kb.cert.org/vuls/id/862559
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free