crypto/x509: Fix interaction of DNS exclude constraints with wildcard DNS names.

F-BORINGSSL-001-005

Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.

Recorded evidence

—score not recorded

google/boringsslReported fixgoogle/boringssl

crypto/x509: Fix interaction of DNS exclude constraints with wildcard DNS names.

fixed publicly

details

Finding IDs: F-BORINGSSL-001-005
Status: fixed publicly
Reported via: Google OSS VRP / Chromium issue 487821920
Note: excluded dNSName wildcard SAN bypass. accepted via Google OSS VRP; public BoringSSL commit 5774eca6004e landed on 2026-03-04 as CL 90167 and updates crypto/x509/v3_ncons.cc plus tests for excluded DNS constraints interacting with wildcard SANs. the commit message references Bug: 488306305, while the tracked external report id is 487821920.

F-BORINGSSL-001-005: Verification failures. Excluded DNS constraints are not correctly applied to wildcard SANs. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-BORINGSSL-001-005

Security area (1seal assessment): Identity. Excluded DNS constraints are not correctly applied to wildcard SANs. Reviewed 24 Sep 2026.

Clarify or correct this record privately. The email subject includes the finding ID. For an existing case, continue the agreed private thread. Do not post unpublished vulnerability details in public issues. Research disclosure policy.

How this page groups evidence

This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.