The vulnerability in wolfSSL (CVE-2026-89133) arises from a defect in the X.509 certificate validation logic where NameConstraints extensions are not properly enforced if there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. Specifically, the chain-walking state machine resets the validation state upon encountering an intermediate CA without NameConstraints, bypassing cryptographic delegation controls. This causes wolfSSL to incorrectly accept certificates for hostnames outside the allowed constraints. The flaw exists in the default build configuration that uses certificates with name constraints. The issue was reported by Jack Lloyd, PathDiff, and Ben Smyth.

The vulnerability allows wolfSSL to accept certificates for hostnames they should not be authorized to cover, potentially undermining the trust model of certificate validation. This could lead to improper acceptance of certificates, weakening the security guarantees of TLS connections that rely on wolfSSL for certificate validation. However, there is no indication of confidentiality or availability impact, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when relying on wolfSSL versions 5.9.2 and earlier for certificate validation involving NameConstraints extensions. Monitoring vendor channels for updates is recommended.