https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 14:19:22 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-89134 <p>A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert-&gt;subjectCN != NULL &amp;&amp; cert-&gt;altNames == NULL &amp;&amp; !cert-&gt;isCA instead of &#34;no dNSName SAN&#34;, so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.</p> <p>A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert-&gt;subjectCN != NULL &amp;&amp; cert-&gt;altNames == NULL &amp;&amp; !cert-&gt;isCA instead of &#34;no dNSName SAN&#34;, so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-89134 https://vulnerability.circl.lu/vuln/ghsa-p2xv-vrwq-543q <p>A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert-&gt;subjectCN != NULL &amp;&amp; cert-&gt;altNames == NULL &amp;&amp; !cert-&gt;isCA instead of &#34;no dNSName SAN&#34;, so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.</p> <p>A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert-&gt;subjectCN != NULL &amp;&amp; cert-&gt;altNames == NULL &amp;&amp; !cert-&gt;isCA instead of &#34;no dNSName SAN&#34;, so an out-of-scope CN was accepted. This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in wolfSSL version 5.9.2.</p> https://vulnerability.circl.lu/vuln/ghsa-p2xv-vrwq-543q