There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed
    the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL
    && cert->altNames == NULL && !cert->isCA instead of "no dNSName SAN", so an out-of-scope CN was accepted.
    This incomplete fix from CVE-2026-6731, leading to the name-constraint check issue, was introduced in
    wolfSSL version 5.9.2. (CVE-2026-89134)

  - In all builds that make use of (D)TLS, including default builds, there is a series of conditional states
    during the TLS shutdown which could lead to a heap-use-after free. If an application ended up getting a
    partial wolfSSL_read() which is sometimes caused by a small user buffer passed in, then called
    wolfSSL_shutdown for a bidirectional close and attempted to wolfSSL_read() again while the peer continues
    trying to send data during the shutdown it would lead to a state where a potential heap-use-after free
    happened. (CVE-2026-15442)

  - In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple
    OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling
    with the HAVE_CERTIFICATE_STATUS_REQUEST_V2 feature and calls wolfSSL_UseOCSPStaplingV2(ssl,
    WOLFSSL_CSR2_OCSP_MULTI, options), the client accepts any certificate in the peer's chain as a certificate
    authority without verifying that the certificate is actually authorized to act as one. This means that an
    attacker who possesses any certificate that chains to a CA trusted by the client (along with its private
    key) can forge certificates for arbitrary identities that will be accepted as valid by the client. The end
    entity certificate of the server is stored in the persistent trust store, affecting subsequent connections
    that reuse the context even when OCSP multi usage is not employed. Found by internal wolfSSL testing.
    (CVE-2026-89102)

  - wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails
    to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-
    constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted certificates for
    hostnames they shouldn't be allowed to cover, due to a chain-walking state-machine bug that resets the
    validation state when encountering an intermediate without NameConstraints, thereby bypassing
    cryptographic delegation controls. This defect exists in the default build configuration that makes use of
    certificates where name constraint extensions are used. Thanks to Jack Lloyd, PathDiff, and Ben Smyth for
    reporting the issue. (CVE-2026-89133)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 失败的 X509_verify_cert 调用会在共享的 CertManager 中永久植入未经验证的攻击者 CA，从而绕过每个类型盲同级使用者（本机 TLS、OCSP、CRL、直接 CM 验证）中的证书验证。这会影响5.8.45.9.2包含宏 （OPENSSL_EXTRA &&; ！NO_CERTS &; &; ！WOLFCRYPT_ONLY） 定义或构建，--enable-opensslextra并且应用程序专门调用 X509_verify_cert 函数。（CVE-2026-89135）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 失敗的 X509_verify_cert 呼叫會在共用的 CertManager 中永久植入未經驗證的攻擊者CA，繞過每個類型盲同級消費者 （原生 TLS、OCSP、CRL、直接 CM 驗證） 中的憑證驗證。這會影響5.8.45.9.2具有巨集 （OPENSSL_EXTRA &&; ！NO_CERTS &; ！WOLFCRYPT_ONLY） 定義或建置--enable-opensslextra，且應用程式會特別呼叫 X509_verify_cert 函式。（CVE-2026-89135）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - X509_verify_cert呼び出しに失敗すると、検証されていない攻撃者のCAが共有 CertManager に恒久的に植え込まれ、あらゆる型盲検の兄弟コンシューマー(ネイティブ TLS、OCSP、CRL、ダイレクト CM 検証)で証明書検証がバイパスされます。これは、マクロ(OPENSSL_EXTRA &; !NO_CERTS &; ! を使用した wolfSSL のバージョン 5.8.4 から 5.9.2 に影響を与えますWOLFCRYPT_ONLY) --enable-opensslextra で定義または構築され、アプリケーションが X509_verify_cert 関数を具体的に呼び出しています。(CVE-2026-89135)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager,     bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM     verify). This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros (OPENSSL_EXTRA && !NO_CERTS     && !WOLFCRYPT_ONLY) defined or built with --enable-opensslextra and the application is specifically making     calls to the X509_verify_cert function. (CVE-2026-89135)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
474888	Alpine: multiple wolfssl packages: security update to 5.9.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/16/2026	10/16/2026	high
474888	Alpine: multiple wolfssl packages: security update to 5.9.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/16/2026	10/16/2026	high
350874	Linux Distros 未修补的漏洞：CVE-2026-89135	Nessus	Misc.	9/28/2026	10/3/2026	medium
350874	Linux Distros 未修補弱點：CVE-2026-89135	Nessus	Misc.	9/28/2026	10/3/2026	medium
350874	Linux Distros のパッチ未適用の脆弱性: CVE-2026-89135	Nessus	Misc.	9/28/2026	10/3/2026	medium
350874	Linux Distros Unpatched Vulnerability : CVE-2026-89135	Nessus	Misc.	9/28/2026	10/3/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium

medium