Haskell TLS library ignores X.509 NameConstraints

The crypton-x509-validation library fails to enforce NameConstraints, letting a compromised sub-CA impersonate any domain to Haskell TLS clients.

CERT/CC disclosed CVE-2026-9648, a vulnerability in the Haskell crypton-x509-validation library used by the Haskell TLS software stack to validate X.509 certificates. The library fails to enforce RFC 5280 NameConstraints, a mechanism that restricts which domains a delegated certificate authority (sub-CA) is permitted to issue certificates for. Because this check is never performed, an attacker who compromises or controls a name-constrained sub-CA can mint a certificate with a Subject Alternative Name for any domain, and Haskell TLS clients will accept it as valid.

Exploitation requires an attacker to already have access to a sub-CA key, then set up a malicious server and lure a Haskell client into connecting to it, enabling a man-in-the-middle scenario where credentials, financial data, or other sensitive traffic could be intercepted. The vulnerability primarily threatens organizations using delegated PKI structures — a common pattern in banking, insurance, and financial data-processing environments where Haskell is used for backend services such as fraud detection and risk modeling. The vendor has released crypton-x509-validation version 1.9.1 to address the flaw; all prior versions are vulnerable. CERT/CC notes the attack requires considerable setup and victim interaction, reducing practical exploitability despite the significant potential impact.

Source reporting: https://kb.cert.org/vuls/id/862559