CVE-2026-89135

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89135
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89135.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-89135
Downstream
Published
2026-09-27T09:14:44Z
Modified
2026-10-01T03:30:20Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Failed X509_verify_cert leaves unverified CA in shared CertManager
Details

A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM verify). This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros (OPENSSL_EXTRA && !NO_CERTS && !WOLFCRYPT_ONLY) defined or built with --enable-opensslextra and the application is specifically making calls to the X509_verify_cert function.

Database specific 
{
    "cna_assigner":  "wolfSSL",
    "cwe_ids":  [
        "CWE-295"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89135.json"
}
References

Affected packages

Git / github.com/wolfssl/wolfssl

Affected ranges

Type
GIT
Repo
https://github.com/wolfssl/wolfssl
Events
Introduced
59f4fa568615396fbf381b073b220d1e8d61e4c2
Fixed
ac01707f552c611fbd135cc723b2682b3e7f80f2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "5.8.4"
        },
        {
            "last_affected":  "5.9.2"
        },
        {
            "fixed":  "5.9.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v5.*
v5.8.4-stable
v5.9.0-stable
v5.9.1-stable
Other
wolfEntropy2d

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89135.json"