Certificates that include a wildcard DNS Subject Alternative Name bypass certificate authority name‑constraint checks; an attacker can present a certificate that should be rejected because its domain is outside the CA’s permitted range. The effect is that a verifier using this wolfSSL library could blindly accept the certificate, enabling domain impersonation or man‑in‑the‑middle attacks. This flaw falls under CWE‑295, improper certificate validation.

The vulnerability is present in theSSL SSL/TLS library. No specific version range is listed in the advisory; therefore any installation of wolfSSL that has not incorporated the fix from the referenced pull request is potentially affected.

The CVSS score of 6.3 indicates a moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely occur during a TLS handshake where the victim application trusts wolfSSL to enforce name‑constraint checks. Because no exploit code is publicly available and the issue relies on the application’s trust behavior, the risk level depends on how broadly wolfSSL is used and whether the environment requires strict name‑constraint enforcement.