CVE-2026-89135
6.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Summary
A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM verify). This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros (OPENSSL_EXTRA && !NO_CERTS && !WOLFCRYPT_ONLY) defined or built with –enable-opensslextra and the application is specifically making calls to the X509_verify_cert function.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| wolfSSL | wolfSSL | 5.8.4 <= 5.9.2 | affected |
Weaknesses
- CWE-295: CWE-295 Improper Certificate Validation
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.