CVE-2026-89134
Received Received - Intake

Certificate Name Constraint Bypass in wolfSSL

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: wolfSSL Inc.

Description
A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-89134
EUVD
EUVD-2026-87913

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wolfssl wolfssl 5.9.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a certificate that lacks a dNSName Subject Alternative Name (SAN) but includes another SAN type, such as registeredID or iPAddress. Due to an incomplete fix from a previous CVE, the system incorrectly accepted the certificate's Common Name (CN) as a DNS name even when no valid dNSName SAN was present. This bypassed the name-constraint check, allowing out-of-scope CN values to be trusted.

Detection Guidance

To detect this vulnerability, inspect certificates for the presence of non-dNSName SAN types (e.g., registeredID or iPAddress) alongside the absence of a dNSName SAN. Check if the CN fallback mechanism incorrectly accepts out-of-scope CN values. Use OpenSSL or similar tools to examine certificate details.

Impact Analysis

This vulnerability could allow attackers to bypass security checks by presenting a certificate with a misleading CN. If exploited, it may enable unauthorized access to systems or data, as the certificate would appear valid despite violating name constraints. Systems relying on DNS name constraints for validation could be tricked into trusting malicious certificates.

Compliance Impact

This vulnerability could allow improper certificate validation, potentially enabling unauthorized access to sensitive data. For GDPR, this may impact data protection measures by allowing unauthorized parties to bypass security controls. For HIPAA, it could compromise the integrity of protected health information by permitting invalid certificates to be accepted.

Mitigation Strategies

Update wolfSSL to the latest version that includes the fix for this vulnerability. The patch was merged into the master branch on July 8, 2026, addressing the incorrect fallback mechanism in DNS name constraint checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89134. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart