CVE-2026-5263 PUBLISHED

URI nameConstraints not enforced in ConfirmNameConstraints()

Assigner: wolfSSL
Reserved: 31.03.2026 Published: 09.04.2026 Updated: 09.04.2026

URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N
CVSS Score: 7

Product Status

Vendor wolfSSL
Product wolfSSL
Versions Default: unaffected
  • affected from 0 to 5.9.1 (excl.)

Credits

  • Oleh Konko @1seal finder

References

Problem Types

  • CWE-295 Improper Certificate Validation CWE