Vulnerability · Published Sep 27, 2026 · Assigned by wolfSSL
CVE-2026-89135Failed X509_verify_cert leaves unverified CA in shared CertManager
Medium 6.3
In plain English
A medium-severity improper certificate validation in wolfSSL from wolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM verify). This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros (OPENSSL_EXTRA && !NO_CERTS && !WOLFCRYPT_ONLY) defined or built with --enable-opensslextra and the application is specifically making calls to the X509_verify_cert function.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | wolfssl | 5.9.4-r0 | ALPINE-CVE-2026-89135 |
| Debian:12 | wolfssl | no fix listed | DEBIAN-CVE-2026-89135 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-89135 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-89135 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-89135 |
| Ubuntu:26.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-89135 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N