HSEC-2023-0006 x509-validation does not enforce pathLenConstraint
The x509-validation library fails to enforce path length constraints, allowing unauthorized intermediate CAs to issue certificates that are incorrectly accepted.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is HSEC-2023-0006?
HSEC-2023-0006 is a vulnerability in x509-validation, published on 14 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
x509-validation does not enforce pathLenConstraint
x509-validation prior to version 1.4.8 did not enforce the pathLenConstraint value. Constrained CAs could accidentally (or deliberately) issue CAs below the maximum depth and x509-validation would accept certificates issued by the unauthorised intermediate CAs.
Which versions are affected by HSEC-2023-0006?
1 open source package ship an affected version, including x509-validation.
| Package | Affected | Fixed in |
|---|---|---|
x509-validation Hackage | From 1.4.0 | 1.4.8 |
How do I fix HSEC-2023-0006?
Upgrade x509-validation to 1.4.8 or later.
Is HSEC-2023-0006 being exploited?
There is no known exploitation of HSEC-2023-0006 in the wild and no public exploit code.