CVE-2026-89135

Name of the Vulnerable Software and Affected Versions wolfSSL versions 5.8.4 through 5.9.2

Description A failure in the X509 verify cert() function allows an unverified attacker CA to be permanently stored in the shared CertManager. This leads to a bypass of certificate validation across all type-blind sibling consumers, including native TLS, OCSP, CRL, and direct CertManager verification. This issue occurs when the software is built with the --enable-opensslextra flag or the macros OPENSSL EXTRA, !NO CERTS, and !WOLFCRYPT ONLY defined, and the application specifically calls the X509 verify cert() function.

Recommendations As a temporary mitigation, avoid using the X509 verify cert() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.