CVE-2026-89136
CVE-2026-89136 · Client accepts unsolicited RawPublicKey server certificate type
This page contains facts from public vulnerability sources. Check the original advisory before updating.
When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.
CVSS 8.3 · High · EPSS 0.4%
- Published
- Updated
Stack: system
Affected products and versions
wolfssl
- Versions
- ≥ 5.6.0, ≤ 5.9.2: Affected (semver)
No fix published
wolfssl Debian:13
- Versions
- 5.7.2-0.1
- 5.7.2-0.1+deb13u1
- 5.7.2-0.1+deb13u2
- 5.7.2-0.2
- 5.7.2-0.3
- 5.7.2-0.4
- 5.8.2-1
- 5.8.2-1.1
- 5.8.2-1.2
- 5.8.4-1
- 5.9.0-0.1
- 5.9.0-0.2
- 5.9.1-0.1
- 5.9.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:16.04:LTS
- Versions
- 3.4.8+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:18.04:LTS
- Versions
- 3.10.2+dfsg-2
- 3.12.0+dfsg-1
- 3.12.2+dfsg-1
- 3.13.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:20.04:LTS
- Versions
- 4.1.0+dfsg-2
- 4.2.0+dfsg-1
- 4.2.0+dfsg-2
- 4.2.0+dfsg-3
- 4.3.0+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:22.04:LTS
- Versions
- 4.6.0-3
- 5.0.0-1
- 5.1.1-1
- 5.2.0-1
- 5.2.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:24.04:LTS
- Versions
- 5.5.4-2
- 5.5.4-2.1
- 5.6.4-2
- 5.6.6-1.2
- 5.6.6-1.3
- 5.6.6-1.3build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:26.10
- Versions
- 5.9.1-0.1
- 5.9.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:26.04:LTS
- Versions
- 5.7.2-0.1
- 5.8.2-1.2
- 5.8.4-1
- 5.9.1-0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published