Patch Forecast
Amber warning
Patch this week.

CVE-2026-89134

A certificate with no dNSName SAN but another SAN type present (e.g

Risk score
60/100
CVSS
9.1 v3.1
Exploit chance (30 days)
0.2%
Published
27 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. Th…
Affected
Wolfssl
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: WolfsslTHE FLAWSTHE FIXCVE-2026-89134A certificate with no dNSNameSAN but another SAN typepresent (e.gCVSS 9.1 · EPSS 0%CVE-2026-93302Authentication bypassCVSS 8.2 · EPSS 0%CVE-2026-94418UnderWOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse()…CVSS 7.5 · EPSS 0%CVE-2026-89102In wolfSSL versions 5.7.2through 5.9.2 there is aclient-side implementation…CVSS 6.5 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedWolfsslAMBER · PATCH THIS WEEKWolfsslA certificate with no dNSNameSAN but another SAN typepresent (e.g. registeredID oriPAddress) bypassed the SubjectCN dNSName name-constraintcheck. The CN-as-DNS fallbackwas gated on cert->subjectCN…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-295 (CWE-295)80 other warnings in 30 days →Same productEarlier Wolfssl warnings6 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Wolfssl: Amber, patch this week. A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. Th…

The flaws

  • CVE-2026-89134: A certificate with no dNSName SAN but another SAN type present (e.g (CVSS 9.1 · EPSS 0%)
  • CVE-2026-93302: Authentication bypass (CVSS 8.2 · EPSS 0%)
  • CVE-2026-94418: Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check… (CVSS 7.5 · EPSS 0%)
  • CVE-2026-89102: In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961… (CVSS 6.5 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Wolfssl

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.1 critical
  • Remotely exploitable without logging in

References

Original description

A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.

Last activity 27 Sep 2026. Patch Forecast updates every hour.