Name constraints for URI names were incorrectly accepted

Name constraints were accepted for certificates asserting a wildcard name

CRLs not considered authoritative by Distribution Point due to faulty matching logic

AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN

rustls-webpki: CPU denial of service in certificate path building

webpki: CPU denial of service in certificate path building