rectly allows a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of <code>*.example.com</code>, Envoy incorrectly allows <code>nested.subdomain.example.com</code>, when it should only allow <code>subdomain.example.com</code>.<ul><li>CVSS Score: 6.6 <a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N/E:F/RL:O/RC:C&amp;version=3.1">AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N/E:F/RL:O/RC:C</a></li></ul></li></ul><p>Istio us