PatchTheCVECVE-2026-5263: URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain ver
CVE-2026-5263 is a medium-severity flaw (CVSS 6.5) affecting wolfssl. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 93%) |
| CISA exploited list | No |
| Weakness | CWE-295 |
| Published | 2026-04-09 |
| Last modified | 2026-07-02 |
Last updated 2026-07-02 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-5263?
wolfssl: upgrade to 5.9.1. Exact commands for each OS are on this page.
Is CVE-2026-5263 being exploited?
CVE-2026-5263 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-5263 affect?
CVE-2026-5263 affects wolfssl. Severity is medium (CVSS 6.5). URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violat
How urgent is CVE-2026-5263?
Priority 25/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2026-55967 HIGH 7.5 UPGRADE AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly
- CVE-2026-7532 HIGH 7.5 UPGRADE iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined
- CVE-2026-6678 MEDIUM 5.3 UPGRADE Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect leng
- CVE-2026-6679 HIGH 7.5 UPGRADE A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authen
- CVE-2026-6681 MEDIUM 5.3 UPGRADE The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to