Log in Start free

Vulnerability · Published Jun 11, 2026 · Assigned by certcc

CVE-2026-9648CVE-2026-9648

Critical 9.1

In plain English

A critical-severity security flaw in crypton-certificate from Haskell Programming Language. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.2%top 87.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13haskell-crypton-x509no fix listedDEBIAN-CVE-2026-9648
Debian:14haskell-crypton-x509no fix listedDEBIAN-CVE-2026-9648
Debian:13haskell-crypton-x509-validationno fix listedDEBIAN-CVE-2026-9648
Debian:14haskell-crypton-x509-validationno fix listedDEBIAN-CVE-2026-9648
Ubuntu:24.04:LTShaskell-crypton-x509-validationno fix listedUBUNTU-CVE-2026-9648
Ubuntu:25.10haskell-crypton-x509-validationno fix listedUBUNTU-CVE-2026-9648
Ubuntu:26.04:LTShaskell-crypton-x509-validationno fix listedUBUNTU-CVE-2026-9648
Ubuntu:26.10haskell-crypton-x509-validationno fix listedUBUNTU-CVE-2026-9648

Affected products (as reported)

VendorProductVersions
Haskell Programming Language crypton-certificate 0 – before 1.9.1

References