BoringSSL has identified five issues related to how certificate name constraints are applied to Subject Alternative Names. These findings concern the legacy crypto/x509 path and the newer pki path within BoringSSL. Two of the vulnerabilities, VU#410595.8 and .12, concerning wildcard DNS names and trailing-dot DNS names respectively, have been fixed. VU#410595.9, related to URI constraints and colons before '@', has been accepted and is under coordination. VU#410595.10, regarding first-@ domain extraction in rfc822Name matching, remains disputed due to unclear exploitation potential. VU#410595.11, concerning trailing-dot handling in rfc822Name domains, was declined by the BoringSSL team as it was deemed below their security threshold. The impact of these issues is limited to scenarios where name constraints are enforced, trusted signatures are obtainable over attacker-controlled SAN fields, and the accepted name is used for authorization. The presence of BoringSSL in a product does not automatically imply that the product is affected, as specific paths and name forms must be invoked. Fixes for the vulnerabilities are applied through BoringSSL's upstream repository and subsequently integrated into products via their update mechanisms. Operators are advised to verify if their deployments use affected paths, apply available updates, and ensure that issued SANs are well-formed to mitigate potential risks.