PT-2026-31793 · Wolfssl · Wolfssl

Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-5263

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WolfSSL (affected versions not specified)

Description WolfSSL improperly handles URI name constraints from constrained intermediate Certificate Authorities (CAs) during certificate chain verification. The parsing of these constraints occurs, but they are not enforced. This allows a compromised or malicious sub-CA to issue leaf certificates with URI Subject Alternative Name (SAN) entries that violate the name constraints of the issuing CA, and WolfSSL will accept these certificates as valid.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-5263

Affected Products

Wolfssl

References · 9

• https://github.com/wolfSSL/wolfssl/pull/10048 · Patch
• https://ubuntu.com/security/CVE-2026-5263 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5263 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5263 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-5263 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5263 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2042397931483853025 · Twitter Post
• https://twitter.com/CVEnew/status/2042561845748445471 · Twitter Post