Botan's X.509 Distinguished Name decoder incorrectly flattens multi-AVA Relative Distinguished Names, causing the first Common Name value to be used for name‑constraint checks while the second value, which an attacker can choose, is ignored during enforcement. This allows a malicious intermediate CA to issue a certificate that satisfies a name‑constraint policy on the surface while introducing an additional hostname that is not covered by the constraint. The attacker can then use the certificate for the unintended hostname if the certificate lacks a subjectAlternativeName extension. The weakness is a failure to preserve multi‑value RDN grouping before name‑constraint evaluation, which is related to CWE‑1023 and CWE‑295.

The vulnerability affects the randombit Botan library versions prior to 3.13.0. The affected product is botan, a C++ cryptography library used in various applications that rely on X.509 processing and DN name‑constraint enforcement.

The CVSS score is 2.1, indicating low severity. EPSS is not available and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires control over a name‑constrained intermediate CA and the ability to issue a certificate that lacks a subjectAlternativeName. Because name‑constraint enforcement is uncommon outside internal PKIs, the risk to most deployments is limited. An attacker could still compromise entity authentication if the system accepts the flawed certificate for hostname verification.