An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade goUpgrade docker | Dec 5, 2025 | Dec 3, 2025 |
| Amazon Linux Ami 2 | — | Upgrade nerdctl-debuginfoUpgrade cri-tools-debuginfoUpgrade docker-debuginfoUpgrade dockerUpgrade containerdUpgrade golistUpgrade containerd-debuginfoUpgrade golist-debuginfoUpgrade soci-snapshotterUpgrade golang-github-cpuguy83-go-md2manUpgrade cni-plugins-debuginfoUpgrade golang-miscUpgrade cri-toolsUpgrade golangUpgrade golang-binUpgrade golang-testsUpgrade cni-pluginsUpgrade golang-srcUpgrade nerdctlUpgrade amazon-ecr-credential-helper-debuginfoUpgrade oci-add-hooksUpgrade amazon-ecr-credential-helperUpgrade oci-add-hooks-debuginfoUpgrade runfinch-finchUpgrade runc-debuginfoUpgrade amazon-cloudwatch-agentUpgrade containerd-stressUpgrade ecs-initUpgrade golang-sharedUpgrade golang-docsUpgrade runc | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade amazon-ecr-credential-helperUpgrade containerd-debugsourceUpgrade containerd-stressUpgrade oci-add-hooks-debugsourceUpgrade amazon-ssm-agentUpgrade captree-debuginfoUpgrade libcap-debuginfoUpgrade cni-pluginsUpgrade containerd-debuginfoUpgrade oci-add-hooks-debuginfoUpgrade golang-docsUpgrade amazon-cloudwatch-agentUpgrade containerdUpgrade golang-binUpgrade libcap-debugsourceUpgrade cni-plugins-debugsourceUpgrade runc-debuginfoUpgrade golang-sharedUpgrade runcUpgrade docker-debugsourceUpgrade nerdctlUpgrade ecs-initUpgrade golang-srcUpgrade golang-miscUpgrade runfinch-finchUpgrade golang-testsUpgrade docker-debuginfoUpgrade dockerUpgrade cni-plugins-debuginfoUpgrade runc-debugsourceUpgrade golangUpgrade containerd-stress-debuginfoUpgrade libcapUpgrade captreeUpgrade libcap-develUpgrade soci-snapshotterUpgrade oci-add-hooksUpgrade libcap-static | Jan 12, 2026 | Dec 3, 2025 |
| Dell Idrac | — | Upgrade Dell iDRAC to the latest version | Jun 26, 2026 | Jun 25, 2026 |
| Freebsd | — | Upgrade oauth2-proxy | Jan 27, 2026 | Jan 18, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 3, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub