← CVE Intelligence

CVE-2026-5263

URI nameConstraints not enforced in ConfirmNameConstraints() PUBLISHED

Description (CNA)

URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.

Affected (CNA)

Vendor / productVersions
wolfSSL / wolfSSLaffected 0 before 5.9.1

CWE

CWE-295

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.