{"id":"CVE-2026-5263","title":"URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c","summary":"URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that vio…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-295"],"vendor":"wolfssl","product":"wolfssl","affected":["wolfssl < 5.9.1"],"patched":["wolfssl 5.9.1"],"published":"2026-04-09","updated":"2026-07-02","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-5263","references":[{"url":"https://github.com/wolfSSL/wolfssl/pull/10048","label":"facts@wolfssl.com"},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2410","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00172,"epssPercentile":0.06971,"ingestedAt":"2026-07-02T15:38:24.958Z","slug":"CVE-2026-5263","body":"## Overview\n\nURI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.\n\n## Affected\n\n- `wolfssl < 5.9.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `wolfssl 5.9.1`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}