CVE-2026-5263 - URI nameConstraints not enforced in ConfirmNameConstraints()

Back Back to CVE browser

HIGH

URI nameConstraints not enforced in ConfirmNameConstraints()

Published Apr 9, 2026

7.0

HIGH

CVSS 4.0

EPSS 0.25%

Description

URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.

Affected products

Vendor wolfSSL Product wolfSSL Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <5.9.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

wolfSSL

unaffected

Version	Status	Constraints
0	affected	<5.9.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21178
Advisory
https://github.com/wolfSSL/wolfssl/pull/10048
Issue TrackingPatch
https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2410

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21178		Advisory
https://github.com/wolfSSL/wolfssl/pull/10048		Issue TrackingPatch
https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2410