CVE-2009-0653: OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, w...

Security readout for executives and security teams

This CVE describes an old OpenSSL certificate-validation weakness, probably in OpenSSL 0.9.6. A vulnerable client could accept a certificate chain that should not be trusted, allowing a man-in-the-middle attacker to impersonate trusted websites. The public record is sparse and does not identify a precise supported product matrix or patch. Exposure is most plausible in legacy systems, embedded clients, appliances, or bundled software still using very old OpenSSL 0.9.6-era validation code. The supplied sources do not prove impact in modern OpenSSL releases. Prioritize investigation if the organization runs legacy appliances, embedded software, or old client stacks. Modern environments are less likely exposed, but the impact is serious where present because TLS trust can be bypassed. Mitigation focus: Inventory systems and products using OpenSSL 0.9.6-era libraries.; Check OpenSSL and vendor guidance for affected versions and supported fixes.; Upgrade or replace unsupported OpenSSL builds after compatibility testing..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.