CVE-2026-9648 describes a vulnerability in the crypton-x509-validation library used in the Haskell programming language. The library fails to enforce X.509 NameConstraints, a critical check that restricts the domains a subordinate CA can issue certificates for. Due to this oversight, TLS clients relying on this library may accept certificates with Subject Alternative Names that fall outside the intended permitted subtrees defined by the issuing CA. This allows an attacker who has compromised a name-constrained sub-CA to impersonate domains beyond the sub-CA's authorized namespace, potentially undermining TLS security assumptions.

An attacker who compromises a name-constrained sub-CA can issue certificates for domains outside the sub-CA's permitted scope, enabling impersonation of unauthorized domains. This undermines the trust model of TLS and may lead to man-in-the-middle attacks or other impersonation-based exploits where clients rely on the vulnerable library for certificate validation.

Patch status is not yet confirmed — check the vendor advisory at https://www.kb.cert.org/vuls/id/862559 for current remediation guidance. Until a fix is available, users should consider alternative certificate validation methods or libraries that correctly enforce NameConstraints.