CVE-2026-89135

Name	CVE-2026-89135
Description	A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM verify). This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros (OPENSSL_EXTRA && !NO_CERTS && !WOLFCRYPT_ONLY) defined or built with --enable-opensslextra and the application is specifically making calls to the X509_verify_cert function.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150338

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wolfssl (PTS)	bookworm	5.5.4-2+deb12u2	fixed
	bookworm (security)	5.5.4-2+deb12u3	fixed
	trixie	5.7.2-0.1+deb13u2	fixed
	sid	5.9.2-1.2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
wolfssl	source	bookworm	(not affected)
wolfssl	source	trixie	(not affected)
wolfssl	source	(unstable)	(unfixed)	1150338

Notes

[trixie] - wolfssl <not-affected> (Vulnerable code not present, see #1149565)
[bookworm] - wolfssl <not-affected> (no WOLFSSL_TEMP_CA path)
https://github.com/wolfSSL/wolfssl/pull/11009 (v5.9.4-stable)