EUVD-2026-87922
GHSA-vrp7-vcfx-j447
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated cert validation flaw, but AC:H due to the required name-constrained/unconstrained multi-tier chain; limited MITM impact gives C:L/I:L, no availability effect.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
1DescriptionCVE.org
wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted certificates for hostnames they shouldn't be allowed to cover, due to a chain-walking state-machine bug that resets the validation state when encountering an intermediate without NameConstraints, thereby bypassing cryptographic delegation controls. This defect exists in the default build configuration that makes use of certificates where name constraint extensions are used. Thanks to Jack Lloyd, PathDiff, and Ben Smyth for reporting the issue.
AnalysisAI
Certificate name-constraint enforcement can be bypassed in wolfSSL 5.9.2 and earlier, allowing a certificate to be accepted for hostnames it is not authorized to cover. The X.509 path-validation state machine loses track of NameConstraints when an intermediate CA without a NameConstraints extension sits between a name-constrained CA and the leaf, so the effective trust delegation is not enforced; exploitation requires a PKI topology with exactly that chain shape and a relying party that uses name constraints in its default build. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a PKI trust chain where a name-constrained intermediate CA is followed by an UNCONSTRAINED CA tier above the leaf, and the affected relying party (wolfSSL 5.9.2 or earlier) must actually rely on NameConstraints extensions for trust decisions in its default build. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine certificate-validation defect but a low-to-moderate real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the corrective change is in https://github.com/wolfSSL/wolfssl/pull/10687, so apply that patch or upgrade to the first wolfSSL release that contains it, and verify the release notes rather than assuming a version number not stated in the advisory data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
Authentication bypass in wolfSSL TLS clients built with Raw Public Key (RPK) support allows a malicious or on-path serve
wolfSSL builds that enable the WOLFSSL_TRUST_PEER_CERT macro can be induced to accept a forged clone of a trusted-peer C
Certificate forgery in the wolfSSL client (versions 5.7.2 through 5.9.2) lets a remote attacker who already holds any ce
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today