CVE-2026-95208 is a vulnerability in wolfSSL versions 5.9.1 and 5.9.2 affecting the ConfirmNameConstraints() function. It allows attackers to cause a Denial of Service (DoS) by providing crafted Certificate Authority certificates. This leads to valid certificates without Subject Alternative Names (SAN) being incorrectly rejected by wolfSSL-based TLS clients. The vulnerability has a high severity with a CVSS score of 7.5.
WolfSSL versions 5.8.4 through 5.9.2 with certain build configurations have a vulnerability where a failed X509_verify_cert call can permanently add an unverified attacker CA to the shared CertManager. This flaw bypasses certificate validation for all consumers relying on the shared CertManager, including native TLS, OCSP, CRL, and direct certificate manager verification. The issue arises only when specific macros (OPENSSL_EXTRA, NO_CERTS, WOLFCRYPT_ONLY) are set in a particular way or when built with --enable-opensslextra, and the application explicitly calls X509_verify_cert.
CVE-2026-89134 is a vulnerability in wolfSSL version 5.9.2 and certain other versions where a certificate lacking a dNSName Subject Alternative Name (SAN) but containing other SAN types can bypass the name-constraint check on the Subject Common Name (CN). This occurs due to fallback logic that incorrectly permits an out-of-scope CN when specific SAN types are present, leading to a name-constraint check bypass. The vulnerability has a CVSS score of 9.1, indicating high severity with impact on integrity and availability. Multiple wolfSSL versions, including some Debian/Ubuntu package versions, are affected. No patch or remediation information is provided in the source data.
wolfSSL versions 5.9.2 and earlier contain a vulnerability in the X.509 certificate validation logic. The flaw involves improper enforcement of NameConstraints extensions when an unconstrained CA tier exists between a name-constrained intermediate CA and the leaf certificate. This results in acceptance of certificates for unauthorized hostnames due to a chain-walking state-machine bug that resets validation state incorrectly. The issue affects the default build configuration using certificates with name constraints. The vulnerability has a medium severity with a CVSS v3.1 score of 5.3.
This vulnerability involves a bypass of IP address name constraints in WOLFSSL when the WOLFSSL_IP_ALT_NAME configuration is not defined. In this configuration, IP address constraints specified by the issuing Certificate Authority (CA) are not enforced, allowing certificates to bypass these restrictions. No specific affected versions are stated. There is no known exploit in the wild, and no patch or official remediation has been indicated.
A vulnerability in wolfSSL versions 5.9.0 and earlier allows the PKCS#7 decode function to write decoded content beyond the bounds of the provided output buffer due to ignoring the caller-supplied buffer size. This issue was fixed in version 5.9.1.
A heap buffer overflow vulnerability exists in the DTLS 1.3 ACK serialization path of wolfSSL versions 5.9.0 and earlier. The flaw is caused by an integer truncation error that leads to allocation of an undersized buffer, which is then overrun. This vulnerability was fixed in wolfSSL version 5.9.1.
This vulnerability involves certificates with wildcard DNS Subject Alternative Names (SANs) bypassing Certificate Authority (CA) name-constraint checks. Specifically, a certificate containing a wildcard DNS SAN (e.g., *.example.com) that should be rejected due to the issuing CA's permitted or excluded DNS name constraints may be incorrectly accepted. This issue relates to improper enforcement of name constraints in certificate validation.
An integer overflow vulnerability existed in the static function wolfssl_add_to_chain, that caused heap corruption when certificate data was written out of bounds of an insufficiently sized certificate buffer.wolfssl_add_to_chain is called by these API: wolfSSL_CTX_add_extra_chain_cert, wolfSSL_CTX_add1_chain_cert, wolfSSL_add0_chain_cert. These API are enabled for 3rd party compatibility features: enable-opensslall, enable-opensslextra, enable-lighty, enable-stunnel, enable-nginx, enable-haproxy. This issue is not remotely exploitable, and would require that the application context loading certificates is compromised.
Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH (Encrypted Client Hello) support, where a maliciously crafted ECH config could cause a stack buffer overflow on the client side, leading to potential remote execution and client program crash. This could be exploited by a malicious TLS server supporting ECH. Note that ECH is off by default, and is only enabled with enable-ech.
Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extension parsing logic when calculating a buffer length, which resulted in writing beyond the bounds of an allocated buffer. Note that in wolfSSL, ECH is off by default, and the ECH standard is still evolving.
CVE-2026-3503 is a medium severity vulnerability in wolfSSL's wolfCrypt library version 5.8.2 affecting ARM Cortex-M microcontrollers. The flaw involves incorrect usage of seeds in the pseudo-random number generator (PRNG) within post-quantum cryptographic implementations (ML-KEM and ML-DSA). Physical attackers can induce transient faults to corrupt or redirect seed or pointer values during the Keccak-based expansion process, potentially compromising key material or cryptographic outcomes. Exploitation requires physical access and high attack complexity, with no user interaction needed. This vulnerability impacts confidentiality due to possible key leakage but has limited scope and availability impact. No known exploits are reported in the wild. Organizations using affected wolfSSL versions on ARM Cortex-M devices should prioritize patching or apply hardware-level protections against fault injection attacks.
Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a denial-of-service via a crafted ClientHello message with duplicate CKS extensions.