Excluded iPAddress name constraints with an all-zero mask are not applied
An `excluded_subtrees` iPAddress name constraint with an all-zero mask (`0.0.0.0/0` or `::/0`) does not restrict iPAddress SANs in certificates issued beneath it. The mask check treated an all-zero mask as matching nothing, when a `/0` prefix matches every address of its family, so the exclusion was silently ignored. CA/Browser Forum Baseline Requirements §7.1.2.5.2 require exactly these exclusions on every technically constrained sub-CA that may not issue for IP addresses. As a result, anyone holding (or having compromised) the key of such a sub-CA can issue a certificate for an arbitrary IP address, and `Validator` with `RFC5280Policy` and `ServerIdentityPolicy` accepts it for that address. A `permitted_subtrees` dNSName entry on the same issuer does not prevent this, because iPAddress SANs are a different name form. All users of `Validator` with `RFC5280Policy` are affected when a chain can contain a name-constrained issuer with an all-zero iPAddress exclusion. The issue is fixed in x509-validator 0.3.1 (commit [da661f8](https://github.com/namecare/x509-validator/commit/da661f8ecee820e05d089a76ecb654ff52a2c987)). Users should upgrade to 0.3.1 or later.
RUSTSEC-2026-0312
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:RUSTSEC-2026-0312
x509-validator
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.3.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0.0.0-0"
},
{
"fixed": "0.3.1"
}
]
}
],
"package": {
"name": "x509-validator",
"purl": "pkg:cargo/x509-validator",
"ecosystem": "crates.io"
},
"database_specific": {
"cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0312.json",
"categories": [
"crypto-failure"
],
"informational": null
},
"ecosystem_specific": {
"affects": {
"os": [],
"arch": [],
"functions": []
},
"affected_functions": null
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #21285 · Revision 1
- Added to Heist Feed
- Publisher date