CVE-2026-89136 — Client accepts unsolicited RawPublicKey server certificate type

CVE-2026-89136

Client accepts unsolicited RawPublicKey server certificate type PUBLISHED

Description (CNA)

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Affected (CNA)

Vendor / product	Versions
wolfSSL / wolfSSL	affected 5.6.0 through 5.9.2

CWE

CWE-287

References

https://github.com/wolfSSL/wolfssl/pull/11009

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.