Is CVE-2026-7532 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7532 being exploited in the wild.

How severe is CVE-2026-7532?

Informational severity, with a CVSS score of 5.7, published 25 June 2026.

Is there a fix for CVE-2026-7532?

A patch was published on 2026-05-08: Fix merged into wolfSSL master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7532 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-7532?

Check whether you run Wolfssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7532: wolfSSL IP address name constraints bypass when WOLFSSL_IP_ALT_NAME is undefined

CVE-2026-7532 · Severity: info · CVSS 5.7 · Published 2026-06-25

wolfSSL is a security library used to protect communications for embedded devices and cloud services. A configuration issue was found where the library fails to enforce certain IP address restrictions on digital certificates if a specific setting (WOLFSSL_IP_ALT_NAME) is not enabled. This could allow a malicious or compromised certificate authority to issue certificates for unauthorized IP addresses, potentially leading to impersonation or unauthorized access within a restricted network.

Technologies: Wolfssl. Vendors: Wolfssl.

Quick answers

Is CVE-2026-7532 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7532 being exploited in the wild.
How severe is CVE-2026-7532?: Informational severity, with a CVSS score of 5.7, published 25 June 2026.
Which products and versions are affected?: Wolfssl <= 5.9.1.
Is there a fix for CVE-2026-7532?: A patch was published on 2026-05-08: Fix merged into wolfSSL master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7532 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-7532?: Check whether you run Wolfssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in wolfSSL's certificate validation logic (CWE-295) where iPAddress name constraints are not enforced if the WOLFSSL_IP_ALT_NAME macro is undefined. In this configuration, the library fails to parse and store iPAddress GeneralNames, causing the ConfirmNameConstraints function to skip enforcement of permitted or excluded subtrees for IP addresses. An attacker with the ability to influence certificate issuance from a constrained intermediate CA could bypass these restrictions. The issue was addressed by ensuring iPAddress and registeredID GeneralNames are parsed and stored unconditionally for constraint enforcement, regardless of whether human-readable string helpers are enabled. Fixes are available in versions following 5.9.1.

Affected products

wolfSSL wolfSSL <= 5.9.1

Timeline

2026-04-29: other: Pull request submitted to fix the issue
2026-05-08: patched: Fix merged into wolfSSL master branch
2026-06-25: advisory: CVE-2026-7532 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.