CVE-2026-9648 describes a vulnerability in the crypton-x509-validation library used in the Haskell programming language. The library fails to enforce X.509 NameConstraints, a critical check that restricts the domains a subordinate CA can issue certificates for. Due to this failure, TLS clients relying on this library may accept certificates with Subject Alternative Names outside the authorized subtrees defined by the issuing CA. This flaw allows an attacker who has compromised a name-constrained sub-CA to issue certificates that impersonate domains beyond their intended scope, undermining TLS authentication.

An attacker who compromises a name-constrained subordinate CA can exploit this vulnerability to impersonate arbitrary domains outside the CA's permitted subtrees. This can lead to man-in-the-middle attacks, unauthorized access, and trust violations in TLS communications relying on the affected library. The vulnerability has a high confidentiality and integrity impact but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory at https://www.kb.cert.org/vuls/id/862559 for current remediation guidance. Until a fix is available, users should consider alternative certificate validation methods or libraries that properly enforce X.509 NameConstraints. Monitor vendor communications for updates and apply official fixes once released.