CVE-2026-7532: iPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined
iPAddress name constraints bypass when WOLFSSLIPALTNAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certificate to bypass an issuing CA's IP address constraints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Define WOLFSSL_IP_ALT_NAME so iPAddress name constraints are enforced and a certificate cannot bypass an issuing CA's iPAddress name constraints when WOLFSSL_IP_ALT_NAME is undefined.
wolfSSL WOLFSSL_IP_ALT_NAME = defined
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7532?
The severity of CVE-2026-7532 is classified as medium, with a CVSS score of 5.7.
How can I fix CVE-2026-7532?
To fix CVE-2026-7532, ensure that WOLFSSL_IP_ALT_NAME is defined in your wolfSSL configuration.
What does CVE-2026-7532 affect?
CVE-2026-7532 affects the wolfSSL library, specifically its handling of IP address name constraints.
What happens if CVE-2026-7532 is not addressed?
If CVE-2026-7532 is not addressed, certificates may bypass the issuing CA's IP address constraints, leading to potential security vulnerabilities.
When was CVE-2026-7532 published?
CVE-2026-7532 was published on June 25, 2026.