wolfSSL CVE-2026-95208 Improper Certificate Name Constraint Validation (CWE-295)

Vulnerability Overview CVE ID: CVE-2026-95208 Product Name: wolfSSL - 5.9.2, 5.9.4, master (v5.9.1 and earlier are not affected) Type: Improper Certificate Validation (CWE-295) Description: wolfSSL’s function incorrectly applies name constraints to certificates lacking a Subject Alternative Name (SAN) extension. This causes valid, CA-issued certificates without a SAN to be rejected with an error, thereby breaking TLS connections to legitimate servers. Direction: No attacker input required. Details: RFC 5280 Section 4.2.1.10 specifies that name constraints only apply if the certificate contains the specified name form. If the in a certificate is not a form, wolfSSL’s function incorrectly injects the as a synthetic entry and matches it against the CA’s allowed/excluded subtrees when no SAN is present. If the CA is outside the allowed subtree, the check fails, returning an error. The code comment references RFC 6265 6.4.4, but that guidance pertains to reference identifier (hostname) checks, not path validation name constraints. Root Cause: Commit e7b7fddacac ("Apply DNS constraints to subject CN when SAN is not available.", 2026-04-14, first appeared in v5.9.2-stable) introduced CN injection to perform "no SAN type" checks when . PR #18837 "DNS name constraint fix" (merged on 2026-07-09) fixed internal issue 20922078. This fix, first appearing in v5.9.4-stable, relaxed constraints to "no dNSName SAN." Previously, certificates carrying non-dNSName SANs (such as IP addresses or registeredID) suppressed CN checks and bypassed constraints, which triggered this issue. Affected Functions: - - Injects synthetic for non-CA certificates lacking SAN (master lines 19980, 20004-20018; v5.9.4 lines 20167/20171; v5.9.2 original gating at line 18593: ) - - Matches the synthetic entry against constraints - Call chain in verification path: ( ) Version Matrix: - v5.9.0 / v5.9.0 / v5.9.1 - Not affected (no CN injection) - v5.9.2 - Affected (certificates without SAN) - All (original gating); v5.9.4 and master - Additionally affected certificates carrying non-dNSName SANs (relaxed constraints) Isolation Evidence: - Critical NC root + leaf without SAN - OpenSSL -> leaf -> 188: Same leaf compatible with OpenSSL (internal constraints) -> Verification OK; leaf with SAN dNSName=example.com -> Verification OK; Non-critical NC -> Still 188 (criticality is irrelevant), truly unknown critical extensions produce error 188, excluding mishandling of unknown critical extensions. Attack Scenario: No attacker input required. Any wolfSSL-based TLS client validating a certificate chain issued by a PKI with dNSName constraints (e.g., banking, government, enterprise deployments) will reject all certificates lacking a SAN, regardless of whether they are within the allowed subtree; from v5.9.4 onwards, this also applies to certificates carrying non-dNSName SANs. Legitimate servers become unreachable. Scope Affected Versions: wolfSSL 5.9.2, 5.9.4, master Unaffected Versions: v5.9.1 and earlier Remediation Fix Commit: PR #18837 "DNS name constraint fix" (merged on 2026-07-09) Fix Content: Fixed internal issue 20922078 by relaxing constraints to "no dNSName SAN." Previously, certificates carrying non-dNSName SANs (such as IP addresses or registeredID) suppressed CN checks and bypassed constraints. POC Code POC Link: https://github.com/ikloiver/poc/tree/main/CVE-2026-95208

Goal Reached Thanks to every supporter — we hit 100%!

wolfSSL CVE-2026-95208 Improper Certificate Name Constraint Validation (CWE-295)

More from this source