Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

wolfSSL 5.9.2 may accept out-of-scope certificate names

CVE-2026-89134 · published 22 days ago
Summary

The wolfSSL library version 5.9.2 can mistakenly trust a digital certificate that contains a special address field instead of a regular website name. This means a connection could be made to a server that should have been blocked, potentially exposing data. Update to a newer wolfSSL release or apply the vendor's patch to fix the name‑checking logic.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– wolfssl wolfssl 5.9.2
Debian:12 debian wolfssl All versions
Ubuntu:16.04:LTS canonical wolfssl All versions
Original advisory text
Subject CN name-constraint check bypassed when non-DNS SAN present
A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published27 Sep 2026
Updated17 Oct 2026
First seen27 Sep 2026
Sources
CVE-2026-89134 · NVD
CVE-2026-89134 · MITRE
DEBIAN-CVE-2026-89134 · OSV
CVE-2026-89134 · OSV
UBUNTU-CVE-2026-89134 · OSV
Track software like this
Free during beta