{"id":"CVE-2026-89134","title":"A certificate with no dNSName SAN but another SAN type present (e.g","summary":"A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL …","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-295"],"vendor":"wolfSSL","product":"wolfSSL","affected":["wolfSSL 5.9.2"],"published":"2026-09-27","updated":"2026-09-27","sourceUpdated":"2026-09-27T10:16:59.030","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89134","references":[{"url":"https://github.com/wolfSSL/wolfssl/pull/10837","label":"facts@wolfssl.com"}],"tags":["nvd","cve.org"],"cvssSource":"cna","ingestedAt":"2026-09-27T09:45:46.033Z","slug":"CVE-2026-89134","body":"## Overview\n\nA certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of \"no dNSName SAN\", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}