CVE-2026-89135

EUVD-2026-87912

27.09.2026, 10:16

A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM verify). This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros (OPENSSL_EXTRA && !NO_CERTS && !WOLFCRYPT_ONLY) defined or built with --enable-opensslextra and the application is specifically making calls to the X509_verify_cert function.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
wolfSSL	CNA	6.3 MEDIUM	NETWORK	HIGH	NONE	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 9.72%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
wolfssl	wolfssl	5.8.4 ≤ 𝑥 ≤ 5.9.2	CNA

Debian Releases

Debian Product

Codename

wolfssl

bookworm	vulnerable
bookworm (security)	vulnerable
sid	vulnerable
trixie	vulnerable

Common Weakness Enumeration

CWE-295 - Improper Certificate Validation
The software does not validate, or incorrectly validates, a certificate.

References

https://github.com/wolfSSL/wolfssl/pull/11009