AIKIDO-2026-986556
spomky-labs/pki-framework is vulnerable to Improper Certificate Validation
91
Critical Risk
This Affects:
spomky-labs/pki-frameworkTL;DR
PathValidator decodes the X.509 nameConstraints extension but never applies the RFC 5280 permitted or excluded subtree checks, including when the extension is marked critical. The related methods are empty stubs, so a constrained intermediate CA is treated as unconstrained. A leaf certificate with names outside the issuing CA's allowed namespace is accepted, which can impersonate identities the CA was not meant to cover. Version 1.6.2 implements the missing name-constraint processing during path validation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you validate certification paths with CertificationPath or PathValidator, especially when you rely on name-constrained intermediate CAs in the trust store.
Background info
spomky-labs/pki-framework is vulnerable to Improper Certificate Validation in versions 1.0.0 - 1.6.1.
How to fix this
Upgrade the spomky-labs/pki-framework library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.