Excluded iPAddress name constraints with an all-zero mask are not applied

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

An `excluded_subtrees` iPAddress name constraint with an all-zero mask (`0.0.0.0/0` or `::/0`) does not restrict iPAddress SANs in certificates issued beneath it. The mask check treated an all-zero mask as matching nothing, when a `/0` prefix matches every address of its family, so the exclusion was silently ignored. CA/Browser Forum Baseline Requirements §7.1.2.5.2 require exactly these exclusions on every technically constrained sub-CA that may not issue for IP addresses. As a result, anyone holding (or having compromised) the key of such a sub-CA can issue a certificate for an arbitrary IP address, and `Validator` with `RFC5280Policy` and `ServerIdentityPolicy` accepts it for that address. A `permitted_subtrees` dNSName entry on the same issuer does not prevent this, because iPAddress SANs are a different name form. All users of `Validator` with `RFC5280Policy` are affected when a chain can contain a name-constrained issuer with an all-zero iPAddress exclusion. The issue is fixed in x509-validator 0.3.1 (commit [da661f8](https://github.com/namecare/x509-validator/commit/da661f8ecee820e05d089a76ecb654ff52a2c987)). Users should upgrade to 0.3.1 or later.

Source published

24 Sep 2026 12:00:00 UTC

Source modified

28 Sep 2026 09:45:02 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N