Several widely used TLS libraries mishandle nameConstraints on intermediate certificates: a crafted intermediate can assert authority over namespaces its issuing root explicitly excluded. Validation succeeds where it must fail.
Impact
An attacker who obtains any constrained intermediate — for example, an enterprise CA constrained to .corp.example — can issue certificates for arbitrary public domains that affected clients will accept. The flaw defeats the exact mechanism that makes constrained intermediates safe to delegate.
Affected versions
Patched releases are available from all affected vendors. Update the TLS library, not just the application: statically linked copies are the ones that linger. Embedded and appliance firmware pinning old versions are the long tail — inventory them now.
Detection and mitigation
Until patched, treat constrained intermediates as unconstrained in your risk model. Certificate Transparency monitoring will surface misuse of publicly trusted hierarchies; private hierarchies need CA-side issuance auditing, because the client-side check is the thing that is broken.