Red Hat CVE-2026-32884

Botan is a C++ cryptography library used for SSL/TLS and certificate validation. The vulnerability exists in the X.509 certificate path validation logic that processes name constraints, specifically the excludedSubtrees constraint as defined in RFC 5280. When an end-entity certificate lacks a Subject Alternative Name (SAN) extension, RFC 5280 technically does not require validation of the Common Name (CN) against name constraints; however, Botan implements this additional check. The root cause (CWE-295: Improper Certificate Validation) stems from a case-sensitive string comparison when evaluating whether a CN matches a DNS name constraint. RFC 5280 specifies that DNS name comparisons must be performed in a case-insensitive manner. A certificate with CN=Sub.EVIL.COM would bypass an excludedSubtrees constraint for evil.com because the uppercase characters in the CN do not match the lowercase constraint during the case-sensitive comparison, allowing the certificate to be incorrectly validated as compliant with the constraint.