CVE-2026-89135

Name
CVE-2026-89135
Description
A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM verify). This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros (OPENSSL_EXTRA && !NO_CERTS && !WOLFCRYPT_ONLY) defined or built with --enable-opensslextra and the application is specifically making calls to the X509_verify_cert function.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
facts@wolfssl.com https://github.com/wolfSSL/wolfssl/pull/11009

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:* wolfssl >= 5.8.4 <= 5.9.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
wolfssl edge-community 5.9.2-r0 Pavlo Dembytskyi <me@devs.boo> possibly vulnerable
wolfssl edge-community 5.9.1-r0 Pavlo Dembytskyi <me@devs.boo> possibly vulnerable
wolfssl edge-community 5.9.0-r0 Pavlo Dembytskyi <me@devs.boo> possibly vulnerable
wolfssl edge-community 5.8.4-r2 Pavlo Dembytskyi <me@devs.boo> possibly vulnerable
wolfssl edge-community 5.8.4-r1 None possibly vulnerable
wolfssl 3.24-community 5.9.1-r0 Pavlo Dembytskyi <me@devs.boo> possibly vulnerable