CVE-2026-95208 wolfSSL CVE debrief

Who should care

Defenders of TLS clients using wolfSSL, specifically those who manage Certificate Authority certificates, should assess exposure and verify wolfSSL versions. They should review Certificate Authority certificate validation in wolfSSL-based TLS clients and monitor for crafted Certificate Authority certificates in network traffic. This vulnerability affects TLS clients using wolfSSL, especially those managing Certificate Authority certificates.

Why it matters

CVE-2026-95208 is a Denial of Service vulnerability in wolfSSL that defenders should prioritize verifying and remediating, especially those managing Certificate Authority certificates in TLS clients.

• DoS via crafted Certificate Authority certificates requires verification of wolfSSL version and Certificate Authority certificate validation
• TLS clients using wolfSSL may reject valid certificates without SAN, impacting communication

Technical summary

The ConfirmNameConstraints() function in wolfSSL v5.9.1 and v5.9.2 is vulnerable to a Denial of Service (DoS) attack via crafted Certificate Authority certificates, causing valid certificates without SAN to be incorrectly rejected by wolfSSL-based TLS clients. This vulnerability allows attackers to cause a Denial of Service (DoS) via providing crafted Certificate Authority certificates. The vulnerability is caused by incorrect validation of Certificate Authority certificates, leading to valid certificates without SAN being rejected.

Defensive priority

TLS clients using wolfSSL should verify their exposure to crafted Certificate Authority certificates

Recommended defensive actions

• Verify wolfSSL version and update to a fixed version if available
• Review Certificate Authority certificate validation in wolfSSL-based TLS clients
• Monitor for crafted Certificate Authority certificates in network traffic
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The issue is in the ConfirmNameConstraints() function of wolfSSL v5.9.1 and v5.9.2. Official sources confirm a Denial of Service (DoS) vulnerability via crafted Certificate Authority certificates. The vulnerability is caused by incorrect validation of Certificate Authority certificates, leading to valid certificates without SAN being rejected. Defenders should verify wolfSSL versions and review Certificate Authority certificate validation in wolfSSL-based TLS clients.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.