CVE-2026-89134 is a critical (CVSS 9.1) certificate validation flaw in wolfSSL. A certificate with a non-DNS subject alternative name can skip the common name check against name constraints. It is an incomplete fix for CVE-2026-6731, introduced in 5.9.2. Update to a release that contains the upstream fix.
What's affected
The record says the incomplete fix for CVE-2026-6731 was introduced in wolfSSL 5.9.2. The upstream pull request that corrects it was merged on 8 July 2026.
I could not confirm which numbered release contains the correction, so check the wolfSSL release notes and changelog, or build from a commit that includes the pull request. The affected case is a certificate that has no DNS name entry in its subject alternative names but has another type, such as an IP address or a registered ID.
How to check if you're exposed
wolfSSL is often compiled into firmware and applications, not installed as a package. Find the version:
grep LIBWOLFSSL_VERSION_STRING wolfssl/version.h
Run that against each source tree or vendored copy. For system packages, ask your package manager for the installed version. Then check whether your application uses name constraints through wolfSSL, for example with a private certificate authority that limits the DNS names an intermediate may issue.
What to do now
- Inventory every product and firmware image that bundles wolfSSL 5.9.2 or later.
- Update to a release that contains the fix from pull request 10837, confirmed from the release notes.
- Rebuild and ship the new binaries, and record the wolfSSL version in each SBOM.
- Test a certificate chain with a name-constrained intermediate and an out-of-scope common name after the update.
- Ask vendors whose devices embed wolfSSL for their fixed firmware.
Why it matters
The weakness is CWE-295 (improper certificate validation). The pull request explains the bug. The code that falls back to the common name as a DNS name was guarded by a condition that required no alternative names at all. It should have run whenever no DNS name was present. A certificate with, say, only an IP address entry therefore skipped the check, and an out-of-scope common name was accepted.
This is a regression class worth knowing: a security fix that covers the reported case but not its neighbours. Test the family of inputs around a flaw, not only the one reported.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Try it yourself
Embedded libraries hide in build trees. An inventory that lists them by version lets you answer the first question fast.
Click through it at your own pace, or open it full screen.
Quick check
Which release has the fix?
I could not confirm a numbered release. The upstream pull request was merged on 8 July 2026, so use a release or commit that includes it.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
