There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed
    the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL
    && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted.
    This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in
    wolfSSL version 5.9.2. (CVE-2026-89134)

  - In all builds that make use of (D)TLS, including default builds, there is a series of conditional states
    during the TLS shutdown which could lead to a heap-use-after free. If an application ended up getting a
    partial wolfSSL_read() which is sometimes caused by a small user buffer passed in, then called
    wolfSSL_shutdown for a bidirectional close and attempted to wolfSSL_read() again while the peer continues
    trying to send data during the shutdown it would lead to a state where a potential heap-use-after free
    happened. (CVE-2026-15442)

  - In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple
    OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling
    with the HAVE_CERTIFICATE_STATUS_REQUEST_V2 feature and calls wolfSSL_UseOCSPStaplingV2(ssl,
    WOLFSSL_CSR2_OCSP_MULTI, options), the client accepts any certificate in the peer's chain as a certificate
    authority without verifying that the certificate is actually authorized to act as one. This means that an
    attacker who possesses any certificate that chains to a CA trusted by the client (along with its private
    key) can forge certificates for arbitrary identities that will be accepted as valid by the client. The end
    entity certificate of the server is stored in the persistent trust store, affecting subsequent connections
    that reuse the context even when OCSP multi usage is not employed. Found by internal wolfSSL testing.
    (CVE-2026-89102)

  - wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails
    to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-
    constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted certificates for
    hostnames they shouldn't be allowed to cover, due to a chain-walking state-machine bug that resets the
    validation state when encountering an intermediate without NameConstraints, thereby bypassing
    cryptographic delegation controls. This defect exists in the default build configuration that makes use of
    certificates where name constraint extensions are used. Thanks to Jack Lloyd, PathDiff, and Ben Smyth for
    reporting the issue. (CVE-2026-89133)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 沒有 dNSName SAN 但存在其他 SAN 類型 （例如 registeredID 或 iPAddress） 的憑證已繞過主體 CN dNSName 名稱條件約束檢查。CN-as-DNS 後援是根據 cert->subjectCN ！= NULL &&; cert->altNames == NULL &&; ！cert->isCA 而不是沒有 dNSName SAN 進行門控，因此接受超出範圍的 CN。
    這個導致名稱約束檢查問題的不完整修正 CVE-2026-6731是在 wolfSSL 版本 5.9.2中引入的。（CVE-2026-89134）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 没有 dNSName SAN 但存在另一种 SAN 类型（例如 registeredID 或 iPAddress）的证书绕过了使用者 CN dNSName 名称限制检查。在 cert->subjectCN ！= NULL &&; cert->altNames == NULL &&; ！cert->isCA 而非无 dNSName SAN 上限制 CN-as-DNS 回退，因此接受超出范围的 CN。
    这个不完整的补丁 CVE-2026-6731来自 ，可导致名称限制检查问题，是在 wolfSSL 版本 5.9.2中引入。（CVE-2026-89134）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - dNSName SAN がないが、別の SAN タイプが存在する証明書(registeredID または iPAddress など)が、サブジェクト CN dNSName の名前制約チェックをバイパスしました。CN-as-DNS フォールバックは、dNSName SAN がないのではなく、cert->subjectCN != NULL &; &; cert->altNames == NULL &; !cert->isCA でゲートされていたため、範囲外の CN が受け入れられました。
    名前制約チェックの問題を引き起こす、 CVE-2026-6731 からのこの不完全な修正は、wolfSSL バージョン 5.9.2 で導入されました。(CVE-2026-89134)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed     the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL     && cert->altNames == NULL && !cert->isCA instead of no dNSName SAN, so an out-of-scope CN was accepted.
    This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in     wolfSSL version 5.9.2. (CVE-2026-89134)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
474888	Alpine: multiple wolfssl packages: security update to 5.9.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/16/2026	10/16/2026	high
474888	Alpine: multiple wolfssl packages: security update to 5.9.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/16/2026	10/16/2026	high
350872	Linux Distros 未修補弱點：CVE-2026-89134	Nessus	Misc.	9/28/2026	10/5/2026	medium
350872	Linux Distros 未修补的漏洞：CVE-2026-89134	Nessus	Misc.	9/28/2026	10/5/2026	medium
350872	Linux Distros のパッチ未適用の脆弱性: CVE-2026-89134	Nessus	Misc.	9/28/2026	10/5/2026	medium
350872	Linux Distros Unpatched Vulnerability : CVE-2026-89134	Nessus	Misc.	9/28/2026	10/5/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium

medium