Summary
generated automatically from NVD datawolfSSL version 5.9.2 contains a name-constraint validation flaw (CWE-295). A certificate that has no dNSName SAN but carries another SAN type, such as registeredID or iPAddress, bypasses the Subject CN dNSName check. The CN-as-DNS fallback was conditioned on subjectCN being set, altNames being NULL and the cert not being a CA, instead of on the absence of a dNSName SAN, so an out-of-scope CN was accepted. This incomplete fix for CVE-2026-6731 is rated 9.1 (CRITICAL, CVSS v3.1).
NVD description
A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.
EPSS · FIRST.org
0.16%probability of exploitation in the next 30 days
Higher than 4% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 27 sept. 2026
- Updated
- 2 oct. 2026
- Status
- Analyzed
- Source
- facts@wolfssl.com
Affected products
Weaknesses (CWE)
References (1)
Similar CVEs
Other vulnerabilities of type CWE-295
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.