CVE-2026-5263

OVERVIEW CVE-2026-5263 is a certificate validation bypass vulnerability in wolfSSL that affects the wolfcrypt library's ASN.1 parsing component. The flaw exists in how URI-based nameConstraints are handled during X.509 certificate chain verification. Specifically, intermediate certification authorities can issue leaf certificates with Subject Alternative Name (SAN) URI entries that violate the nameConstraints restrictions imposed by their issuing CA, and wolfSSL will incorrectly validate these malformed certificates as legitimate. SEVERITY This vulnerability requires a compromised or malicious subordinate CA to exploit, representing a moderate attack complexity scenario. The primary attack vector is network-based, leveraging fraudulent certificate issuance to bypass domain validation controls. The potential impact is significant for applications relying on nameConstraints as a security boundary, potentially allowing unauthorized entities to issue certificates for restricted namespaces. The CVSS score is not yet available, though the FAUCET risk score of 37.0/100 and near-zero EPSS percentile indicate this is viewed as a lower-priority threat relative to the broader vulnerability landscape. EXPLOITATION STATUS There is currently no evidence of active exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog, and no public exploit code is documented. Community attention remains minimal, consistent with the vulnerability's inactive status on security hotlists. Organizations using wolfSSL should apply patches when available as part of standard maintenance cycles.