Skip to main content

Reports detail five BoringSSL Name Constraints findings in SAN validation

Source Decision Insights Threat Desk Published October 14, 2026 Companies 2
Human View Machine View

2 companies named, one of 4 articles referencing VU. Previous coverage: VU#382143 Lowcoder Query Library flaw allows cross-tenant data access (Oct 2026).

Companies mentioned

Best suited for

Seniority
Staff
Job function
Cybersecurity / Security Engineer
Persona
Security Architect
Buyer role
Technical Implementer / Administrator
Decision stage
Post Buy
Adoption curve
Early Majority
Technology maturity
Established Technology
Industry
Information Technology / Cybersecurity / Identity Security / Machine Identity & Certificate Lifecycle Management

Our classification, not the publisher's statement. Best suited for, not only for.

Five findings in BoringSSL describe cases where Name Constraints, which limit the names a subordinate certificate authority may issue, may not be applied as intended to certain subject alternative name forms. Affected records use different validation paths, and they do not share a single status.

Records .8, .9, .10 and .12 concern the legacy crypto/x509 path, while record .11 concerns the newer pki path. VU#410595.8 covers a wildcard DNS name that should not be treated as covering a specifically excluded host. VU#410595.9 covers a URI containing a colon before @ that may cause the wrong host to be used when matching URI constraints. VU#410595.10 covers first-@ domain extraction in rfc822Name constraint matching. VU#410595.11 covers trailing-dot handling in rfc822Name domains. VU#410595.12 covers trailing-dot DNS names that were not always normalized on the legacy validation path.

These findings matter only where Name Constraints are enforced on an affected path, a trusted signature can be obtained over attacker-chosen SAN fields, and the accepted name is used for authorization. Mixed-library environments may accept or reject the same certificate differently. The presence of BoringSSL does not, by itself, mean that Chrome, Android, or other products are affected.

Records .8 and .12 were fixed in commit 5774eca on 2026-03-04. Record .9 is accepted and under coordination. Record .10 is disputed, and whether consuming mail applications interpret multi-@ input in a way that creates deployment exploitation has not been established. Record .11 was declined by the BoringSSL team on 2026-02-28 as below its security threshold.

BoringSSL fixes are committed to the upstream repository and reach products through each product's own update process. CERT/CC is not coordinating BoringSSL fixes, and vendor status can be requested from the BoringSSL team through the Google Issue Tracker. Operators should confirm whether their deployment uses an affected path, apply available updates, and keep issued SANs well formed. A second validator helps only when it uses the same inputs and fails closed.

Blog post, originally published by Timur Snoke at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/reports-detail-five-boringssl-name-constraints-findings-in-san-validation/",
        "name": "Reports detail five BoringSSL Name Constraints findings in SAN validation",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/reports-detail-five-boringssl-name-constraints-findings-in-san-validation/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@type": "Organization",
      "name": "Google"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Staff"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Security Engineer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Architect"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Established Technology"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Cybersecurity / Identity Security / Machine Identity & Certificate Lifecycle Management"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-10-14T09:51:30-06:00",
    "datePublished": "2026-10-14T09:51:25-06:00",
    "description": "BoringSSL Name Constraints findings VU#410595.8 through .12 cover SAN validation; two are fixed, one accepted, one disputed, and one declined by the team.",
    "headline": "Reports detail five BoringSSL Name Constraints findings in SAN validation",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Timur Snoke"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/410595"
    },
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/reports-detail-five-boringssl-name-constraints-findings-in-san-validation/",
      "@type": "WebPage",
      "sdDatePublished": "2026-10-14",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/sans-institute/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/sans-institute/",
        "name": "SANS Institute"
      },
      {
        "@id": "https://decisioninsights.ai/registry/vu/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/vu/",
        "name": "VU"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages