Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| wolfSSL | wolfSSL | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://github.com/wolfSSL/wolfssl/pull/10687 |
|
Sun, 27 Sep 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted certificates for hostnames they shouldn't be allowed to cover, due to a chain-walking state-machine bug that resets the validation state when encountering an intermediate without NameConstraints, thereby bypassing cryptographic delegation controls. This defect exists in the default build configuration that makes use of certificates where name constraint extensions are used. Thanks to Jack Lloyd, PathDiff, and Ben Smyth for reporting the issue. | |
| Title | NameConstraints not enforced across unconstrained intermediate CA | |
| Weaknesses | CWE-295 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: wolfSSL
Published:
Updated: 2026-09-27T09:18:43.843Z
Reserved: 2026-09-10T22:36:42.599Z
Link: CVE-2026-89133
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-27T10:16:58.900
Modified: 2026-09-27T10:16:58.900
Link: CVE-2026-89133
Redhat
No data.
OpenCVE Enrichment
No data.