CVE-2026-89134: Subject CN name-constraint check bypassed when non-DNS SAN present
A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using wolfSSL version 5.9.2 are affected if they rely on dNSName name constraints and validate certificates that use the Common Name as a DNS identity when no dNSName SAN is present.
What certificate conditions are needed to trigger the bypass?
The certificate must have no dNSName SAN, have a Subject CN containing an out-of-scope DNS name, and include at least one other SAN type, such as registeredID or iPAddress. The certificate must not be a CA certificate.
How can I identify potentially affected certificates or validation events?
Look for non-CA certificates with a DNS-like Subject CN, no dNSName SAN entry, and one or more SANs of other types such as iPAddress or registeredID. These certificates may have had their CN DNS name accepted without the intended dNSName name-constraint check.