A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.
PUBLISHED5.2CWE-295
Subject CN name-constraint check bypassed when non-DNS SAN present
Problem type
Affected products
wolfSSL
wolfSSL
5.9.2 - AFFECTED
References
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-89134Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-89134",
"assignerOrgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27",
"assignerShortName": "wolfSSL",
"dateUpdated": "2026-09-27T09:16:58.067Z",
"dateReserved": "2026-09-10T22:37:22.616Z",
"datePublished": "2026-09-27T09:16:58.067Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27",
"shortName": "wolfSSL",
"dateUpdated": "2026-09-27T09:16:58.067Z"
},
"datePublic": "2026-09-26T12:00:00.000Z",
"title": "Subject CN name-constraint check bypassed when non-DNS SAN present",
"descriptions": [
{
"lang": "en",
"value": "A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of \"no dNSName SAN\", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of \"no dNSName SAN\", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2."
}
]
}
],
"affected": [
{
"vendor": "wolfSSL",
"product": "wolfSSL",
"defaultStatus": "unaffected",
"versions": [
{
"version": "5.9.2",
"status": "affected",
"versionType": "semver"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-295 Improper Certificate Validation",
"cweId": "CWE-295",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/wolfSSL/wolfssl/pull/10837"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jorge Milla (Pig-Tail)",
"type": "finder"
}
]
}
}
}