CVE-2026-89133 NameConstraints not enforced across unconstrained intermediate CA
wolfSSL fails to enforce NameConstraints across unconstrained intermediate CAs, allowing attackers to bypass certificate validation restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-89133?
CVE-2026-89133 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 27 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted certificates for hostnames they shouldn't be allowed to cover, due to a chain-walking state-machine bug that resets the validation state when encountering an intermediate without NameConstraints, thereby bypassing cryptographic delegation controls. This defect exists in the default build configuration that makes use of certificates where name constraint extensions are used. Thanks to Jack Lloyd, PathDiff, and Ben Smyth for reporting the issue.
Weakness: CWE-295
Which versions are affected by CVE-2026-89133?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2026-89133?
No fix has been published for CVE-2026-89133 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-89133 being exploited?
There is no known exploitation of CVE-2026-89133 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as AZL-105176, DEBIAN-CVE-2026-89133, GHSA-vrp7-vcfx-j447, UBUNTU-CVE-2026-89133.