Vulnerability · Published Sep 27, 2026 · Assigned by wolfSSL
CVE-2026-89134Subject CN name-constraint check bypassed when non-DNS SAN present
Medium 6.3
In plain English
A medium-severity improper certificate validation in wolfSSL from wolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | wolfssl | 5.9.4-r0 | ALPINE-CVE-2026-89134 |
| Debian:12 | wolfssl | no fix listed | DEBIAN-CVE-2026-89134 |
| Debian:13 | wolfssl | no fix listed | DEBIAN-CVE-2026-89134 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-89134 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-89134 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-89134 |
| Ubuntu:26.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-89134 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N