A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field - extracts and matches a different embedded key, incorrectly authorizing the pinned public key.

Hello,

CERT/CC published three vulnerability notes on 13 and 14 October 2026 about how open-source TLS/X.509 libraries enforce Name Constraints (RFC 5280 section 4.2.1.10). I reported the findings. This is a summary of public fixes and statuses; it does not announce new CVEs.

https://kb.cert.org/vuls/id/573195 https://kb.cert.org/vuls/id/948176 https://kb.cert.org/vuls/id/410595

The differences fall into four areas: DNS-name comparison (RFC 5280 requires case-insensitive matching), IP addresses (the RFC does not say whether IPv4-mapped IPv6 should be treated as IPv4), URI-authority parsing, and wildcards (the RFC does not define wildcard SAN semantics).

Fixed or merged:

pyca/cryptography CVE-2026-34073, fixed in 46.0.6. DNS constraints were checked against the certificate's SANs but not against the requested peer name. GHSA-m959-cc7f-wv43 rustls/webpki wildcards under permitted subtrees: CVE-2026-93601, fixed in 0.103.12 / 0.104.0-alpha.6 (GHSA-xgp8-3hg3-c2mh). Unsupported URI constraints were accepted: CVE-2026-93600, first fix in 0.103.12 / 0.104.0-alpha.6, excludedSubtrees case completed in 0.103.13 / 0.104.0-alpha.7 (GHSA-965h-392x-2mh5). GnuTLS CVE-2026-3833, fixed in 3.8.13. DNS names and the domain part of rfc822Name constraints compared case-sensitively. Independently co-reported. wolfSSL CVE-2026-5263, fixed in 5.9.1: URI constraints parsed but not enforced. Fragment wildcards (e.g. foo.com): PR 9991, in 5.9.1. Note: VU#948176 cites CVE-2026-3547 for the URI report; that CVE record describes an ALPN parsing issue. AWS-LC wildcard Common Name fallback fixed in 1.71.0 / aws-lc-sys 0.39.0 (GHSA-3jrg-j22w-mpmc, GHSA-394x-vwmw-crm3). The same advisory covers Unicode CN; VU#948176 lists that report as still under coordination. Go crypto/x509 CVE-2026-33810, fixed in Go 1.26.2 (GO-2026-4866, co-credited): case handling in wildcard parent-constraint lookup. OpenSSL URI authority: the userinfo scan for @ ran past /, ? or #. PR #30319; OpenSSL confirmed on 2026-09-10 that it is in all then-supported versions. BoringSSL VU#410595.8 (wildcard vs excluded host) and .12 (trailing-dot DNS names) fixed upstream in commit 5774eca (2026-03-04), legacy crypto/x509 path.

Open, disputed or declined (per the notes):

Go two reports in triage; IPv4-mapped IPv6 report not accepted as meeting the security bar OpenSSL userinfo-colon report in triage BoringSSL .9 accepted (upstream change b84dc60, 2026-05-05), .10 disputed, .11 declined Mozilla NSS IP-address report under coordination LibreSSL wildcard report under coordination s2n-tls Common Name fallback report in triage Mbed TLS non-critical Name Constraints not enforced in the reported configuration; vendor treats support as a feature request, reporter's concern disputed

Conditions, according to CERT/CC: an attacker needs a trusted signature over chosen certificate fields, an affected validation path must be reachable, and the application must use the accepted name for authorization. The notes do not report exploitation. Using one of these libraries does not by itself mean a product reaches an affected path.

No test vectors are published for anything not fixed.

Per-finding status with dated sources: https://paperlock.org/findings/

Regards, Oleh Konko 1seal - https://1seal.org/research/

An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of Service (DoS) via providing crafted Certificate Authority certificates, leading to valid certificates without SAN to be incorrectly rejected by wolfSSL-based TLS clients.

src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSHMSGKEXDHGEXGROUP (31) and SSHMSGKEXDHGEXREPLY (33) when a server receives them from an unauthenticated client. IsMessageAllowedServer() applies no direction check to the key exchange message range: when the peer is keying and no particular message is expected, which is the state a server is in for the whole window after it processes the client's KEXINIT because nothing sets handshake->expectMsgId there, the function falls out of its expectation branch without a verdict and reaches a numeric bound that admits every message id from 30 through 34. A client that negotiates diffie-hellman-group-exchange-sha256 and then sends message 31 makes the server run the client-side handler DoKexDhGexGroup(), which validates the attacker-supplied group with two 8-round Miller-Rabin primality tests, one on p and one on (p-1)/2, on a value of up to 8192 bits. The handler then returns success: the server stores the attacker's prime and generator, generates a Diffie-Hellman key pair in the attacker's group, and sends the client-role message SSHMSGKEXDHGEXINIT (32) back to the attacker. Published RFC 3526 safe primes are the worst-case input and cost the attacker nothing to obtain. The primality validation was added in 1.5.0; versions from 1.2.0 through 1.4.22 admit the same message and enter the same client-role path without the primality cost. Message 33 is admitted as well, but on a server it is rejected before any cryptography because no public key check callback is registered, so it carries no comparable cost. Builds that define WOLFSSHNODHGEXSHA256, which is implied by WOLFSSHNODH or NOSHA256, are unaffected.

Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath() in src/ssh.c appends each path component with a remaining-size bound (outSz - curSz) rather than the full destination size, so once the accumulated path reaches half the output buffer the sizet computation n - strlen(s1) - 1 wraps to near SIZEMAX. The strncat() call is then effectively unbounded and copies the whole component; when that component exactly fills the remainder of the buffer, its terminating null is written one byte past the end. The caller's own length check keeps the copied data inside the buffer, so the overflow is limited to that single null byte, which may corrupt an adjacent stack value and crash the process. Applications that call the public wolfSSHRealPath() with an output buffer smaller than the input path are additionally exposed to an unbounded copy, because the word32 expression outSz - segSz in that length check also wraps.

When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid account on the server can exploit this to force a login as a more privileged user. The vulnerability was introduced with the initial Windows port of wolfSSHd in wolfSSH version 1.4.15 and affects all versions through 1.5.0. Non-Windows builds of wolfSSHd are not affected.

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key).

Heap use-after-free on read during bidirectional (D)TLS shutdown

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2(ssl, WOLFSSLCSR2OCSPMULTI, options), the client accepts any certificate in the peer's chain as a certificate authority without verifying that the certificate is actually authorized to act as one. This means that an attacker who possesses any certificate that chains to a CA trusted by the client (along with its private key) can forge certificates for arbitrary identities that will be accepted as valid by the client. The end entity certificate of the server is stored in the persistent trust store, affecting subsequent connections that reuse the context even when OCSP multi usage is not employed. Found by internal wolfSSL testing.

NameConstraints not enforced across unconstrained intermediate CA

A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.

A failed X509verifycert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM verify). This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros (OPENSSLEXTRA && !NOCERTS && !WOLFCRYPTONLY) defined or built with --enable-opensslextra and the application is specifically making calls to the X509verifycert function.

Client accepts unsolicited RawPublicKey server certificate type

MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSLTRUSTPEERCERT and load CA certificates with wolfSSLCTXtrustpeercert() or wolfSSLtrustpeercert(). The peer must know the certificates being loaded to either of those APIs to take advantage of the issue. When OPENSSLCOMPATIBLEDEFAULTS is also defined this widens the affected API to include all CA certificate loading. Both macros are defined when using autoconf builds such as (nginx, haproxy, stunnel, wpas, apache httpd, hitch, bind, rsyslog, ffmpeg, all, distro). When the certificate is listed as a trusted peer certificate the issue previously allowed for a malicious (D)TLS server to bypass authentication once knowing which CA’s the client would accept. This also affects mutual authentication cases where the client knows which CA’s the server has loaded. If building with any of these configurations and using (D)TLS where the loaded CA’s could be known and authentication of the peer is desired, users should either: update to the latest wolfSSL version, apply the fix patch, or use the configure flag --disable-openssl-compatible-defaults and not load CA’s with wolfSSLCTXtrustpeercert() or wolfSSLtrustpeercert() to mitigate the issue.

(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

CRL check skipped when OCSP enabled and certificate has no OCSP URL

Signature failure masked by date error under WOLFSSLSMALLCERTVERIFY

Client session cache reference poisoning allows resumption with wrong server

wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the additional authenticated data. Because the record layer leaves the explicit-nonce field for the cipher to populate, the value read is constant across records, so every AES-CCM record within a connection is encrypted under an identical key and nonce pair. Reusing a CCM key and nonce weakens confidentiality (identical keystream across records, so a known record recovers the others) and integrity (authentication tag forgery). Only wolfEngine is affected; wolfProvider is not. AES-GCM under wolfEngine is tracked separately. AES-CCM cipher suites are not enabled by default and must be explicitly selected, which limits exposure. TLS 1.3 and non-TLS use of the cipher are not affected.

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.

PKCS7verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bound, permitting a forged signature to be accepted.

iPAddress name constraints bypass when WOLFSSLIPALTNAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certificate to bypass an issuing CA's IP address constraints.

wcBlake2bHmacFinal and wcBlake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.

OCSP CertID serial-number length-confusion in wolfSSLOCSPrespfindstatus allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared serial-number bytes without first requiring the two serial numbers to be of equal length, so a SingleResponse for one certificate (same issuer) whose serial is a prefix of the target's serial would match, returning the wrong certificate's status. The fix requires the serial lengths to be equal before comparing the serial bytes.

Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual hosts, carry the cached peer-authentication state into a context it was not established for. Resumption now verifies the SNI/ALPN binding for all paths and declines (falling back to a full handshake) on mismatch.

TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, but it was also being applied while a post-handshake CertificateRequest was still outstanding. The check is now scoped to the initial handshake only: on the server, once a post-handshake CertificateRequest has been sent (certReqCtx is set), a peer certificate and a valid CertificateVerify are required again before the Finished is accepted, with empty-certificate handling following the configured verify mode (FAILIFNOPEERCERT) just as during first-handshake client authentication. Only affects TLS 1.3 servers built with post-handshake authentication support (WOLFSSLPOSTHANDSHAKEAUTH / --enable-postauth, included in --enable-all) that enable WOLFSSLVERIFYPOSTHANDSHAKE and request a client certificate after the handshake via wolfSSLrequestcertificate(). Clients, and servers that do not use post-handshake authentication, are unaffected.

When HAVEENCRYPTTHENMAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC.