Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-89134

Subject CN name-constraint check bypassed when non-DNS SAN present

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
wolfSSL

Description

A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

wolfSSL wolfSSL

Default version status: unaffected

  • 5.9.2affected

References