Aws lc sys: AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN
Affects aws-lc-sysSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.39.0
Data as of 9 Nov 2026, 11:22 UTC
What to do
Upgrade aws-lc-sys to 0.39.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioaws-lc-syspkg:cargo/aws-lc-sysOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in aws-lc-sys version 0.39.0. Applications using affected versions (>=0.32.0 <0.39.0) should upgrade to version 0.39.0 or later. Applications that set the X509_CHECK_FLAG_NEVER_CHECK_SUBJECT flag to disable CN fallback or only encounter certificates with dNSName SANs are not affected and do not require action. No other workarounds are available.
Description
A logic error in the AWS-LC library's Common Name (CN) validation allows certificates with wildcard or raw UTF-8 Unicode CN values to bypass name constraints enforcement. This occurs because the function responsible for CN validation does not recognize these CN patterns as valid DNS identifiers, causing the name constraints check to be skipped. However, hostname verification still accepts these CN values when no dNSName Subject Alternative Name (SAN) is present, enabling bypass of name constraints. Applications using aws-lc-sys versions from 0.32.0 up to but not including 0.39.0 are affected. Customers of AWS services do not need to take action. The issue is fixed in version 0.39.0.