← Vulnerability feed

Vulnerability record · CVE-2026-5263 · published 9 April 2026

CVE-2026-5263: Wolfssl improper certificate validation vulnerability

Wolfssl · Wolfssl

URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.

7.0 CVSS 4.0 High EPSS 0.25% · top 85.0% CWE-295 · Improper certificate validation
7.0CVSS 4.0 base score
0.25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
2 Jul 2026Last modified by NVD

Description

URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/wolfSSL/wolfssl/pull/10048 Issue TrackingPatch
https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2410

Track CVE-2026-5263 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-5991Wolfssl out-of-bounds read vulnerabilityIn function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the fu…EPSS 0.56%9.8CVE-2021-37155Wolfssl vulnerabilitywolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the serial number …EPSS 1.5%9.8CVE-2020-36177Wolfssl out-of-bounds write vulnerabilityRsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size.EPSS 3.5%9.8CVE-2014-2898Wolfssl out-of-bounds read vulnerabilitywolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers an out-o…EPSS 2.8%9.8CVE-2014-2896Wolfssl out-of-bounds read vulnerabilityThe DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact an…EPSS 2.8%9.8CVE-2014-2897Wolfssl out-of-bounds read vulnerabilityThe SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows remote atta…EPSS 2.8%9.8CVE-2019-16748Wolfssl out-of-bounds read vulnerabilityIn wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there…EPSS 1.2%9.8CVE-2019-15651Wolfssl out-of-bounds read vulnerabilitywolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is misha…EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2026-5263), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.