CVE-2026-89134

Name
CVE-2026-89134
Description
A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
facts@wolfssl.com https://github.com/wolfSSL/wolfssl/pull/10837

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:wolfssl:wolfssl:5.9.2:*:*:*:*:*:*:* wolfssl == None == 5.9.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
wolfssl edge-community 5.9.2-r0 Pavlo Dembytskyi <me@devs.boo> possibly vulnerable