View Ridge Security
Back to Cyber Hose

wolfSSL OCSP stapling v2 accepts non-CA chain certificates as issuers

Seven wolfSSL vulnerabilities disclosed, including three CVSS 8.3 flaws in certificate validation and TLS handshake handling.

🔓 CVEs & KEV

  • CVE-2026-89102 — wolfSSL — CVSS 8.3 — OCSP stapling v2 multi accepts non-CA chain certificates as issuersIn wolfSSL...

  • CVE-2026-89136 — wolfSSL — CVSS 8.3 — Client accepts unsolicited RawPublicKey server certificate typeWhen using RPK...

  • CVE-2026-93302 — wolfSSL — CVSS 8.3 — Trusted peer certificate match ignores public key, allowing forged CA clonesM...

  • CVE-2026-89133 — wolfSSL — CVSS 6.3 — NameConstraints not enforced across unconstrained intermediate CAwolfSSL vers...

  • CVE-2026-89134 — wolfSSL — CVSS 6.3 — Subject CN name-constraint check bypassed when non-DNS SAN presentA certifica...

  • CVE-2026-89135 — wolfSSL — CVSS 6.3 — Failed X509_verify_cert leaves unverified CA in shared CertManagerA failed X5...

  • CVE-2026-93304 — wolfSSL — CVSS 6.3 — (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchangeA (D)...

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check