Certificates with wildcard DNS SANs (e.g. *.example.com) bypassed CA name-constraint checks. A certificate with a wildcard DNS SAN that should be rejected by the issuing CA's permitted/excluded DNS name constraints could be accepted.
3.4.8+dfsg-13.10.2+dfsg-23.12.0+dfsg-13.12.2+dfsg-13.13.0+dfsg-14.1.0+dfsg-24.2.0+dfsg-14.2.0+dfsg-24.2.0+dfsg-34.3.0+dfsg-24.6.0-35.0.0-15.1.1-15.2.0-15.2.0-25.5.4-25.5.4-2.15.6.4-25.6.6-1.25.6.6-1.35.6.6-1.3build15.7.2-0.15.7.2-0.15.8.2-1.25.8.4-15.9.1-0.1Exploitability
AV:NAC:LAT:PPR:NUI:NVulnerable System
VC:NVI:LVA:NSubsequent System
SC:NSI:NSA:NCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N