CVE-2026-7532 iPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined

What is CVE-2026-7532?

CVE-2026-7532 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certificate to bypass an issuing CA's IP address constraints.

Weakness: CWE-295

Which versions are affected by CVE-2026-7532?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2026-7532?

Apply the vendor's patch.

Is CVE-2026-7532 being exploited?

There is no known exploitation of CVE-2026-7532 in the wild and no public exploit code.

Other vulnerabilities in Wolfssl Wolfssl

• CVE-2024-5991 Buffer overread in domain name matching Critical 10.0
• CVE-2021-37155 Security feature bypass in n/a Critical 9.8
• CVE-2020-36177 Memory corruption in n/a Critical 9.8
• CVE-2014-2896 Memory corruption in n/a Critical 9.8
• CVE-2014-2897 Memory corruption in n/a Critical 9.8

All Wolfssl Wolfssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-7532, GHSA-h4jr-6mf9-63fq, JLSEC-2026-758, UBUNTU-CVE-2026-7532.