{"id":"HSEC-2023-0006","aliases":[],"status":"published","title":"x509-validation does not enforce pathLenConstraint","description":"# x509-validation does not enforce pathLenConstraint\n\n*x509-validation* prior to version 1.4.8 did not enforce the\npathLenConstraint value.  Constrained CAs could accidentally (or\ndeliberately) issue CAs below the maximum depth and\n*x509-validation* would accept certificates issued by the\nunauthorised intermediate CAs.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-11-14T14:45:34Z","modified":"2025-11-14T18:15:35Z","fixes":[{"ecosystem":"Hackage","package":"x509-validation","fixed_in":["1.4.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Hackage","package":"x509-validation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.8"}]}],"versions":["1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7"]}],"references":[{"url":"https://github.com/haskell-tls/hs-certificate/commit/06d15dbbc53739314760d8504ca764000770e46e","tags":["fix"]}],"sources":{"osv":[{"id":"HSEC-2023-0006","title":"x509-validation does not enforce pathLenConstraint","description":"# x509-validation does not enforce pathLenConstraint\n\n*x509-validation* prior to version 1.4.8 did not enforce the\npathLenConstraint value.  Constrained CAs could accidentally (or\ndeliberately) issue CAs below the maximum depth and\n*x509-validation* would accept certificates issued by the\nunauthorised intermediate CAs.\n","status":"published","published":"2025-11-14T14:45:34Z","modified":"2025-11-14T18:15:35.439845Z","updated_at":"2026-11-02T15:47:17.805107Z"}]}}