# Haskell TLS stack bypasses X.509 NameConstraints Published: 2026-06-11 · Severity: high · Sectors: financial-services, education Canonical: https://vorant.io/reports/13e61ea5-6d44-4229-9106-36754266e7c2/haskell-tls-stack-bypasses-x-509-nameconstraints > CVE-2026-9648 allows attackers with compromised sub-CA keys to impersonate any domain in Haskell TLS clients due to missing NameConstraints enforcement. A critical vulnerability in the Haskell TLS software stack allows attackers to bypass X.509 NameConstraints validation, enabling certificate impersonation attacks. The crypton-x509-validation library fails to enforce RFC 5280 NameConstraints, which restrict which domains a certificate authority can issue certificates for. This allows an attacker who compromises a name-constrained sub-CA to create certificates for domains outside its permitted scope, tricking Haskell clients into accepting them. The vulnerability is particularly concerning for enterprise, academic, and financial systems that commonly use Haskell for backend services including fraud detection and risk modeling. An attacker exploiting this flaw could set up a malicious web server with a fraudulent certificate, intercept connections from vulnerable Haskell clients, and capture credentials and sensitive data transmitted during the session. Industries using delegated PKI structures, typical in banking and financial sectors, face elevated risk. Version 1.9.1 of crypton-x509-validation has been released to address the vulnerability. All prior versions are vulnerable and should be updated immediately. While successful exploitation requires considerable setup and victim interaction, the potential impact on financial and enterprise systems warrants urgent patching. ## Mentioned in this report - Vulnerabilities: CVE-2026-9648 1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers. Source reporting: https://kb.cert.org/vuls/id/862559 --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/13e61ea5-6d44-4229-9106-36754266e7c2/haskell-tls-stack-bypasses-x-509-nameconstraints. Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup