HSEC-2023-0006
x509-validation does not enforce pathLenConstraint
x509-validation does not enforce pathLenConstraint
x509-validation prior to version 1.4.8 did not enforce the pathLenConstraint value. Constrained CAs could accidentally (or deliberately) issue CAs below the maximum depth and x509-validation would accept certificates issued by the unauthorised intermediate CAs.
What each source reports
OSV No score
x509-validation does not enforce pathLenConstraint
x509-validation does not enforce pathLenConstraint
x509-validation prior to version 1.4.8 did not enforce the pathLenConstraint value. Constrained CAs could accidentally (or deliberately) issue CAs below the maximum depth and x509-validation would accept certificates issued by the unauthorised intermediate CAs.
- Record
HSEC-2023-0006- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
x509-validationHackage |
1.4.0 up to 1.4.8, plus listed versions 1.4.11.4.21.4.31.4.41.4.51.4.61.4.7 |
1.4.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
HSEC-2023-0006 is a vulnerability with no CVSS score yet in x509-validation, published November 14, 2025. No source lists public exploit code. Fixed in x509-validation 1.4.8.