CVE-2026-89133: NameConstraints not enforced across unconstrained intermediate CA
wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted certificates for hostnames they shouldn't be allowed to cover, due to a chain-walking state-machine bug that resets the validation state when encountering an intermediate without NameConstraints, thereby bypassing cryptographic delegation controls. This defect exists in the default build configuration that makes use of certificates where name constraint extensions are used. Thanks to Jack Lloyd, PathDiff, and Ben Smyth for reporting the issue.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using wolfSSL 5.9.2 or earlier are affected when they validate certificate chains that use NameConstraints extensions. The issue is present in the default build configuration under that condition.
What certificate-chain condition is required for exploitation?
The chain must contain a name-constrained intermediate CA followed by an unconstrained intermediate CA before the leaf certificate. The unconstrained tier resets NameConstraints validation state, allowing a certificate for an otherwise unauthorized hostname to be accepted.
How can I determine whether a certificate may have bypassed constraints?
Review accepted certificate chains for a NameConstraints-bearing intermediate CA with a later intermediate CA that does not contain NameConstraints. A leaf hostname outside the constrained CA's permitted scope indicates the validation bypass condition.