{"id":"CVE-2026-95208","published":"2026-10-08T16:18:01.420","lastModified":"2026-10-08T21:34:48.800","description":"An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of Service (DoS) via providing crafted Certificate Authority certificates, leading to valid certificates without SAN to be incorrectly rejected by wolfSSL-based TLS clients.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-295"],"vendors":[],"products":[],"references":[{"url":"http://wolfssl.com","tags":[]},{"url":"https://gist.github.com/lkloliver/14edf8bbfbf5769949b85c7f5cc2eba2","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/lkloliver/14edf8bbfbf5769949b85c7f5cc2eba2","tags":[]}],"hasPoc":true,"ai":{"summary":"wolfSSL's ConfirmNameConstraints() function incorrectly rejects valid certificates without Subject Alternative Names (SANs) when processing crafted CA certificates, leading to denial of service in TLS clients that use wolfSSL.","exploitability":"Exploitation is straightforward requiring only a malicious CA certificate with crafted name constraints, no authentication or user interaction needed to trigger the DoS condition.","blast_radius":"The impact could be significant across all TLS clients using wolfSSL v5.9.1 or v5.9.2, potentially affecting web servers, email systems, IoT devices, and other applications that rely on this SSL/TLS library for secure communications.","remediation":"Upgrade to wolfSSL version 5.9.3 or later to address this denial of service vulnerability in the ConfirmNameConstraints() function.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","tls","ssl","certificate"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:25:43.174Z"}}