28928 matches found
CVE-2026-94418
Under WOLFSSLSMALLCERTVERIFY, ProcessPeerCertParse runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signature result back only when the parse returned 0, so any parse error hid it. ParseCertRelative reaches its...
CVE-2026-94419
Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...
AZL-105182 CVE-2026-94418 affecting package mariadb 10.11.19-1
Under WOLFSSLSMALLCERTVERIFY, ProcessPeerCertParse runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signature result back only when the parse returned 0, so any parse error hid it. ParseCertRelative reaches its...
CVE-2026-94419
Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...
UBUNTU-CVE-2026-94418
Under WOLFSSLSMALLCERTVERIFY, ProcessPeerCertParse runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signature result back only when the parse returned 0, so any parse error hid it. ParseCertRelative reaches its...
UBUNTU-CVE-2026-94419
Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...
CVE-2026-94418
Under WOLFSSLSMALLCERTVERIFY, ProcessPeerCertParse runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signature result back only when the parse returned 0, so any parse error hid it. ParseCertRelative reaches its...
EUVD-2026-87912
A failed X509verifycert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer native TLS, OCSP, CRL, direct CM verify. This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros OPENSSLEXTRA &&...
CVE-2026-89136 Client accepts unsolicited RawPublicKey server certificate type
When using RPK Raw Public Key, the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited servercerttype=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR...
CVE-2026-89136
The wolfSSL library is vulnerable to an authentication bypass when using Raw Public Key (RPK) during TLS 1.2 , TLS 1.3 , and DTLS 1.2 connections. The root cause is that the client side could accept an unsolicited server_cert_type=RawPublicKey, allowing a malicious server to bypass authentication...
EUVD-2026-87911
When using RPK Raw Public Key, the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited servercerttype=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR...
CVE-2026-89136 Client accepts unsolicited RawPublicKey server certificate type
When using RPK Raw Public Key, the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited servercerttype=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR...
CVE-2026-89136 Client accepts unsolicited RawPublicKey server certificate type
When using RPK Raw Public Key, the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited servercerttype=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR...
CVE-2026-89136
When using RPK Raw Public Key, the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited servercerttype=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR...
CVE-2026-93302 Trusted peer certificate match ignores public key, allowing forged CA clones
MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSLTRUSTPEERCERT and load CA certificates with wolfSSLCTXtrustpeercert or wolfSSLtrustpeercert. The peer must know the certificates being loaded to...
CVE-2026-93302 Trusted peer certificate match ignores public key, allowing forged CA clones
MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSLTRUSTPEERCERT and load CA certificates with wolfSSLCTXtrustpeercert or wolfSSLtrustpeercert. The peer must know the certificates being loaded to...
EUVD-2026-87910
MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSLTRUSTPEERCERT and load CA certificates with wolfSSLCTXtrustpeercert or wolfSSLtrustpeercert. The peer must know the certificates being loaded to...
CVE-2026-93302
MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSLTRUSTPEERCERT and load CA certificates with wolfSSLCTXtrustpeercert or wolfSSLtrustpeercert. The peer must know the certificates being loaded to...
CVE-2026-93302
The wolfSSL library contains a vulnerability where the MatchTrustedPeer function ignores the public key during verification, allowing forged CA clones to pass. This affects builds enabling the WOLFSSL_TRUST_PEER_CERT macro and loading certificates via wolfSSL_CTX_trust_peer_cert() or wolfSSL_trus...
EUVD-2026-87909
A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...