name constraints

A subtle correctness bug in Go’s X.509 verification code — tracked as CVE-2026-27137 — can cause certificate chains to ignore multiple email-address name constraints when those constraints share the same local-part but differ by domain. The practical upshot: under specific conditions a...

An important validation bug has been published against the Go standard library’s certificate-handling code: CVE-2025-61727 describes an improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509, meaning that an excluded-subdomain constraint in a...