CVE-2026-6731 X.509 name constraint bypass via Subject CN treated as a DNS name

Medium 6.0 Published 25 Jun 2026 Updated 26 Jun 2026

Attackers can bypass X.509 DNS name constraints by exploiting Subject Common Name validation, allowing acceptance of invalid certificates.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-6731?

CVE-2026-6731 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 25 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted.

Weakness: CWE-295

Which versions are affected by CVE-2026-6731?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2026-6731?

Apply the vendor's patch.

Is CVE-2026-6731 being exploited?

There is no known exploitation of CVE-2026-6731 in the wild and no public exploit code.

All Wolfssl Wolfssl vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-6731, GHSA-9c3c-227q-3j67, JLSEC-2026-755, UBUNTU-CVE-2026-6731.