CVE-2026-9648Disclosure

LOWCVSS 9.1 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
Peaked at 3 mentions on most recent observed day (2026-06-16)
4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

250.0%

Patch

250.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-11	1	Disclosure1
2026-06-16	3	Disclosure1Patch2

Full discourse4 posts

yousukezan@yousukezan132d
Disclosure
Haskell向けTLSライブラリ「crypton-x509-validation」に、証明書の検証を回避できる深刻な脆弱性CVE-2026-9648が見つかった。CERT/CCによると、攻撃者は本来許可されていないドメイン向けの証明書を作成し、Haskellクライアントに信頼させることが可能になる。問題は、X.509証明書の「NameConstraints」を検証していなかったことにある。NameConstraintsは認証局（CA）が発行できるドメイン範囲を制限する仕組みだが、影響を受けるライブラリではこの確認が行われていなかった。 CERT/CCによると、その結果として制限付きの下位認証局（sub-CA）が侵害された場合でも、許可されていないドメイン向け証明書を発行できる可能性がある。攻撃者は不正なサーバーを用意し、Haskellクライアントを誘導することで通信内容や認証情報、機密データを取得できるという。記事では、この問題は銀行や保険会社などで利用される委任型PKI環境で特に影響が大きいと説明されている。脆弱性はすべての旧バージョンが影響を受ける。開発者はcrypton-x509-validation 1.9.1で問題を修正した。 https://securityonline.info/haskell-tls-vulnerability-cve-2026-9648/
Post summary
A critical CVE-2026-9648 was discovered in the Haskell TLS library crypton-x509-validation, where missing NameConstraints validation allows attackers to forge certificates for unauthorized domains; the flaw is patched in version 1.9.1.
000601.4K
14.8K followersView on X
Daily CyberSecurity@the_yellow_fall133d
Patch
A Haskell TLS vulnerability (CVE-2026-9648) lets attackers bypass X.509 NameConstraints to impersonate domains. Update crypton-x509-validation to 1.9.1. #Haskell #CVE20269648 #TLS #X509 #InfoSec https://securityonline.info/haskell-tls-vulnerability-cve-2026-9648 https://t.co/VWef70Wuvq
Post summary
The tweet reports a TLS certificate validation flaw (CVE‑2026‑9648) in Haskell that lets attackers bypass X.509 NameConstraints to impersonate domains, and advises updating crypton‑x509‑validation to version 1.9.1.
01040295
12.8K followersView on X
𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_irc132d
Patch
New CVEs (e.g., Haskell TLS CVE-2026-9648) enable forged certs, compromising data privacy/integrity in transit. Recent WP plugin flaws also expose backend data (June 16, 2026). Patch now! #Cybersecurity #Vulnerabilities #News
Post summary
New CVEs, including Haskell TLS CVE‑2026‑9648, cause forged certificates and compromise data in transit, while recent WordPress plugin flaws expose backend data; patches are available immediately.
0000045
15 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-9648 The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall out… https://www.cve.org/CVERecord?id=CVE-2026-9648
Post summary
The crypton-x509-validation Haskell library has a flaw that bypasses X.509 NameConstraints, permitting TLS clients to accept certificates with disallowed Subject Alternative Names.
00000101
57.6K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-9648

yousukezan[verified]@yousukezanDisclosure

A critical CVE-2026-9648 was discovered in the Haskell TLS library crypton-x509-validation, where missing NameConstraints validation allows attackers to forge certificates for unauthorized domains; the flaw is patched in version 1.9.1.

Daily CyberSecurity@the_yellow_fallPatch

The tweet reports a TLS certificate validation flaw (CVE‑2026‑9648) in Haskell that lets attackers bypass X.509 NameConstraints to impersonate domains, and advises updating crypton‑x509‑validation to version 1.9.1.

𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_ircPatch

New CVEs, including Haskell TLS CVE‑2026‑9648, cause forged certificates and compromise data in transit, while recent WordPress plugin flaws expose backend data; patches are available immediately.

CVE@CVEnewDisclosure

The crypton-x509-validation Haskell library has a flaw that bypasses X.509 NameConstraints, permitting TLS clients to accept certificates with disallowed Subject Alternative Names.