EUVD-2026-39549
GHSA-m8r2-qgr6-4gqm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires a name-constrained CA PKI environment (AC:H); no authentication needed on the validation path; integrity-only impact via improper certificate acceptance.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
2DescriptionCVE.org
Certificates with wildcard DNS SANs (e.g. *.example.com) bypassed CA name-constraint checks. A certificate with a wildcard DNS SAN that should be rejected by the issuing CA's permitted/excluded DNS name constraints could be accepted.
AnalysisAI
wolfSSL's certificate chain validation logic incorrectly evaluates wildcard DNS Subject Alternative Names (SANs) against CA-enforced name constraints, allowing certificates that should be rejected under a constrained PKI hierarchy to be silently accepted. Any wolfSSL-powered application that validates certificate chains in a PKI where intermediate or root CAs define permitted or excluded DNS name constraints per RFC 5280 §4.2.1.10 is affected; all versions matching cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:* are listed as affected. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; an upstream patch is available via PR #10549 but a tagged release version has not been independently confirmed.
Technical ContextAI
wolfSSL (CPE: cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*) is a lightweight, embedded C-based SSL/TLS library targeting IoT, RTOS, and resource-constrained environments. RFC 5280 §4.2.1.10 defines the nameConstraints CA extension, which restricts the namespace of subject names permitted in subordinate certificates: an excluded constraint on 'foo.example.com' must reject any SAN that could expand to that hostname, including the wildcard '*.example.com'. The wolfSSL ASN template path (WOLFSSL_ASN_TEMPLATE) contained a byte-length comparison guard during wildcard SAN evaluation that failed to correctly test SAN values against excluded or permitted DNS name constraint entries, permitting violating wildcards to pass unchallenged - a CWE-295 (Improper Certificate Validation) root cause. A parallel flaw existed in URI name constraints: a permitted constraint without a leading dot (e.g., 'host.com') mandates an exact host match under RFC 5280, but wolfSSL incorrectly applied subtree-matching semantics, accepting sub-host URIs such as 'https://www.host.com/' when only 'https://host.com/' should be allowed. The PR diff confirms these two distinct bypass paths and adds comprehensive regression tests covering both excluded and permitted subtree scenarios for DNS and URI GeneralName types.
RemediationAI
Apply the upstream fix available in GitHub PR #10549 (https://github.com/wolfSSL/wolfssl/pull/10549) once it is incorporated into a tagged wolfSSL release; monitor https://www.wolfssl.com/docs/security-vulnerabilities/ for the official release version, as a specific patched version number is not independently confirmed from available data. As a compensating control prior to patching, organizations relying on name-constrained PKI hierarchies for security decisions should implement an independent second-pass validation of certificate name constraints at the application layer using a separately verified library, or enforce a policy that rejects wildcard SANs in contexts where constrained CAs govern access. Rejecting all wildcard SANs will impact legitimate certificates already in production, so an audit of existing wildcard deployments is required before applying this control. Builds using IGNORE_NAME_CONSTRAINTS are not affected by this specific bypass but forfeit all name-constraint enforcement.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today