PT-2026-99515

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 5.9.3 Description An issue exists when an application enables both Online Certificate Status Protocol OCSP and Certificate Revocation List CRL revocation checking on one WOLFSSL CTX or certificate manager. In this...

PT-2026-99517

Name of the Vulnerable Software and Affected Versions wolfSSL versions 5.3.0 through 5.9.2 Description When NO SESSION CACHE REF is undefined, the wolfSSL get session function returns a ClientSession reference to the process-global SessionCache instead of a session object. The...

Linux Distros Unpatched Vulnerability : CVE-2026-94418

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Under WOLFSSLSMALLCERTVERIFY, ProcessPeerCertParse runs the certificate signature check separately from the parse to keep peak memory down, then merges the two...

Linux Distros Unpatched Vulnerability : CVE-2026-15442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all builds that make use of DTLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a...

CVE-2026-15442: Use After Free

In all builds that make use of DTLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use-after free. If an application ended up getting a partial wolfSSLread which is sometimes caused by a small user buffer passed in, then calle...

PT-2026-99516

Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description When the WOLFSSL SMALL CERT VERIFY option is enabled, the ProcessPeerCertParse function executes the certificate signature check separately from the parsing process to reduce peak memory usag...

Linux Distros Unpatched Vulnerability : CVE-2026-93302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSLTRUSTPEERCE...

CVE-2026-89102: Improper Certificate Validation

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...

CVE-2026-94417: Improper Check for Certificate Revocation

When an application enables both OCSP and CRL revocation checking on one WOLFSSLCTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information Access OCSP URL, and accepts a certificate the loaded CRL lists as revoked. The soft-fail policy f...

CVE-2026-82208

A flaw was found in libcurl when using the wolfSSL backend. When CA Certificate Authority caching is enabled and a CURLOPTSSLCTXFUNCTION callback is used to replace the trust store, libcurl can silently reinstall the cached store. This can lead to a scenario where a certificate that should be...

wolfCOSE v2.0.0

wolfCOSE wolfCOSE is a lightweight C library implementing CBOR RFC 8949, COSE RFC 9052/9053, and post-quantum ML-DSA for COSE RFC 9964 using wolfSSL as the crypto backend. Main Features Complete RFC 9052 message set : all six COSE message types, including multi-signer COSESign and multi-recipient...

Astra Linux – Vulnerability in curl

With the wolfSSL backend, when CA caching is enabled and a CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. This results in a certificate trusted by the cached store but rejected by the callback-selected store bei...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the CURLOPTSSLCTXFUNCTION callback process when CA caching is enabled with the wolfSSL backend. An attacker can bypass intended trust store restrictions by presenting a certificate that is trusted by t...

AZL-99756 CVE-2026-82208 affecting package curl 8.11.1-11

With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectl...

AZL-99849 CVE-2026-82208 affecting package rust 1.90.0-10

With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectl...

ALPINE-CVE-2026-82208

With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectl...

AZL-99798 CVE-2026-82208 affecting package mysql 8.0.46-1

With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectl...

CVE-2026-82208

With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectl...

AZL-99840 CVE-2026-82208 affecting package rust 1.75.0-30

With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectl...

CVE-2026-82208 wolfSSL CA-cache hit overrides callback

With the wolfSSL backend, when CA caching is enabled and an CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectl...