AIKIDO-2026-550833

TL;DR

HostnameUtil gates the JSSE hostname verifier's 'match CN when no dNSName SAN exists' fallback with Properties.isOverrideSet(JSSE_HOSTNAME_CHECK_CN_FALLBACK, true), and the two-argument form returns that default when the property is unset. Documentation says the unset default must disable the fallback, but every deployment that does not explicitly set the property to false therefore keeps CN-fallback active. RFC 5280 name constraints only constrain SAN entries of the constrained type, so a leaf with no dNSName SAN can pass a dNSName-constrained chain while HostnameUtil still accepts an attacker-chosen CN that matches the target hostname, weakening TLS hostname verification. The fix calls the single-argument isOverrideSet so CN-fallback stays disabled unless the property is explicitly enabled.