CVE-2026-95208

Summary

wolfSSL's ConfirmNameConstraints() function incorrectly rejects valid certificates without Subject Alternative Names (SANs) when processing crafted CA certificates, leading to denial of service in TLS clients that use wolfSSL.

Exploitability

Exploitation is straightforward requiring only a malicious CA certificate with crafted name constraints, no authentication or user interaction needed to trigger the DoS condition.

Blast radius

The impact could be significant across all TLS clients using wolfSSL v5.9.1 or v5.9.2, potentially affecting web servers, email systems, IoT devices, and other applications that rely on this SSL/TLS library for secure communications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to wolfSSL version 5.9.3 or later to address this denial of service vulnerability in the ConfirmNameConstraints() function.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.