A logic error in the AWS-LC library's Common Name (CN) validation allows certificates with wildcard or raw UTF-8 Unicode CN values to bypass name constraints enforcement. This occurs because the function responsible for CN validation does not recognize these CN patterns as valid DNS identifiers, causing the name constraints check to be skipped. However, hostname verification still accepts these CN values when no dNSName Subject Alternative Name (SAN) is present, enabling bypass of name constraints. Applications using aws-lc-sys versions from 0.32.0 up to but not including 0.39.0 are affected. Customers of AWS services do not need to take action. The issue is fixed in version 0.39.0.