wolfSSL incorrectly treats the Subject Common Name of an X.509 certificate as a DNS type name. This flaw allows a certificate whose CN violates an issuing CA's DNS name constraints to be accepted as valid. The result is that an attacker can present a forged certificate and achieve elevated trust, enabling possible man‑in‑the‑middle attacks or credential spoofing. The weakness is an instance of improper certificate validation, potentially compromising confidentiality, integrity, and authenticity of secure communications.

This vulnerability impacts the wolfSSL library. No specific version range is listed in the CNA data; however, the associated pull request (https://github.com/wolfSSL/wolfssl/pull/10223) indicates that the issue is addressed in a recent change. Systems that rely on wolfSSL for TLS or certificate validation without updating to the fixed version are affected.

The CVSS score of 6 denotes moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. The likely attack vector is through TLS connections where wolfSSL performs certificate verification. An attacker would need to supply a malicious certificate to a system using the affected library; upon processing, the CN is mistakenly checked as a DNS name, bypassing the issuer's name constraints. This bypass permits an otherwise disallowed certificate to be trusted, leading to potential data compromise or impersonation attacks.