CVE-2026-3833

Vendor

Apple, OpenSSL

Product

OpenSSL, Mozilla NSS / GnuTLS / libgcrypt

Exposure class

Operating system

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 19
   CERT/CC note CERT/CC 18d ago

   Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint inconsistency in RFC 5280 implementation

   Overview This note covers differences in how TLS libraries interpret X.509 Name Constraints. A certificate that one library accepts may be rejected by another. Some of those differences are defects; others follow from behavior…

   Fix available CVE-2026-3833CVE-2026-34073 Apple OpenSSL
2. 14
   CERT/CC note CERT/CC 17d ago

   Multiple TLS libraries can bypass delegation enforcement

   Overview This note covers thirteen library-specific records (VU#948176.6, .8–.19) of how widely used TLS libraries apply X.509 Name Constraints. The records describe cases where a constrained name may be accepted by one library…

   Fix available CVE-2026-3833CVE-2026-34073CVE-2026-3547