Root cause, affected code and disclosure timeline.
At a glance
Conditions
A wildcard or Unicode CommonName can bypass name constraints when hostname verification falls back to CN without a DNS name SAN.
What to do
Check the package-specific AWS advisories for fixed versions. Disabling CN fallback avoids this path; do not apply the AWS-LC version number to aws-lc-sys.
1seal reading guide, reviewed 2026-09-25 against the linked records. Not a new vendor assessment or a device rollout check.
Source assessments remain separate. Different CVSS versions are not a revision of one another. Code fixes, released versions and deployed updates are distinct evidence.
Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.
F-AWS-LC-NAMECONSTRAINTS-002: Verification failures. Unicode common names are skipped by name-constraint enforcement. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
Security area (1seal assessment): Identity. Wildcard common names bypass name-constraint enforcement. Unicode common names are skipped by name-constraint enforcement. Reviewed 24 Sep 2026.
F-AWS-LC-NAMECONSTRAINTS-002: Verification failures. Unicode common names are skipped by name-constraint enforcement. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
Security area (1seal assessment): Identity. Wildcard common names bypass name-constraint enforcement. Unicode common names are skipped by name-constraint enforcement. Reviewed 24 Sep 2026.
F-AWS-LC-NAMECONSTRAINTS-002: Verification failures. Unicode common names are skipped by name-constraint enforcement. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
Security area (1seal assessment): Identity. Wildcard or Unicode common names bypass the certificate name constraints governing which identities the CA may certify. Reviewed 24 Sep 2026.
public fix in aws/aws-lc on 2026-03-19 via main commit 2aa522465f69 (#3107) and fips branch commit 35bfa4362e45 (#3108). AWS linked GHSA-3jrg-j22w-mpmc and GHSA-394x-vwmw-crm3 and said CNA scope was not met; the same PRs also close the unicode CN vector tracked as F-AWS-LC-NAMECONSTRAINTS-002.
F-AWS-LC-NAMECONSTRAINTS-001: Verification failures. Wildcard common names bypass name-constraint enforcement. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
F-AWS-LC-NAMECONSTRAINTS-002: Verification failures. Unicode common names are skipped by name-constraint enforcement. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.
This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.