---
id: CVE-2026-89134
title: A certificate with no dNSName SAN but another SAN type present (e.g
summary: >-
  A certificate with no dNSName SAN but another SAN type present (e.g.
  registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint
  check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL &&
  cert->altNames == NULL …
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-295
vendor: wolfSSL
product: wolfSSL
affected:
  - wolfSSL 5.9.2
published: '2026-09-27'
updated: '2026-09-27'
sourceUpdated: '2026-09-27T10:16:59.030'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89134'
references:
  - url: 'https://github.com/wolfSSL/wolfssl/pull/10837'
    label: facts@wolfssl.com
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-09-27T09:45:46.033Z'
---

## Overview

A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.