Alpine: multiple wolfssl packages: security update to 5.9.4-r0

high Tenable Cloud Security Plugin ID 474888

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed
the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL
&& cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted.
This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in
wolfSSL version 5.9.2. (CVE-2026-89134)

- In all builds that make use of (D)TLS, including default builds, there is a series of conditional states
during the TLS shutdown which could lead to a heap-use-after free. If an application ended up getting a
partial wolfSSL_read() which is sometimes caused by a small user buffer passed in, then called
wolfSSL_shutdown for a bidirectional close and attempted to wolfSSL_read() again while the peer continues
trying to send data during the shutdown it would lead to a state where a potential heap-use-after free
happened. (CVE-2026-15442)

- In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple
OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling
with the HAVE_CERTIFICATE_STATUS_REQUEST_V2 feature and calls wolfSSL_UseOCSPStaplingV2(ssl,
WOLFSSL_CSR2_OCSP_MULTI, options), the client accepts any certificate in the peer's chain as a certificate
authority without verifying that the certificate is actually authorized to act as one. This means that an
attacker who possesses any certificate that chains to a CA trusted by the client (along with its private
key) can forge certificates for arbitrary identities that will be accepted as valid by the client. The end
entity certificate of the server is stored in the persistent trust store, affecting subsequent connections
that reuse the context even when OCSP multi usage is not employed. Found by internal wolfSSL testing.
(CVE-2026-89102)

- wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails
to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-
constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted certificates for
hostnames they shouldn't be allowed to cover, due to a chain-walking state-machine bug that resets the
validation state when encountering an intermediate without NameConstraints, thereby bypassing
cryptographic delegation controls. This defect exists in the default build configuration that makes use of
certificates where name constraint extensions are used. Thanks to Jack Lloyd, PathDiff, and Ben Smyth for
reporting the issue. (CVE-2026-89133)

Solution

Update the wolfssl library and its related packages to version 5.9.4-r0 or later.

Plugin Details

Severity: High

ID: 474888

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.36

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2026-89134

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.3

Threat Score: 4.8

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-93302

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/27/2026

Reference Information

CVE: CVE-2026-15442, CVE-2026-89102, CVE-2026-89133, CVE-2026-89134, CVE-2026-89135, CVE-2026-89136, CVE-2026-93302, CVE-2026-93304, CVE-2026-94417, CVE-2026-94418, CVE-2026-94419

IAVA: 2026-A-1082

Detections

Analytics