PT-2026-99514

Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description A DTLS 1.2 client may accept a ChangeCipherSpec message before sending its ClientKeyExchange. Since no master secret is derived at this stage, the client uses read keys derived from a known...

PT-2026-99516

Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description When the WOLFSSL SMALL CERT VERIFY option is enabled, the ProcessPeerCertParse function executes the certificate signature check separately from the parsing process to reduce peak memory usag...

PT-2026-99510

Name of the Vulnerable Software and Affected Versions wolfSSL version 5.9.2 Description A flaw exists where a certificate containing a Subject Alternative Name SAN other than a dNSName such as registeredID or iPAddress, but lacking a dNSName SAN, can bypass the Subject Common Name CN dNSName...

PT-2026-99511

Name of the Vulnerable Software and Affected Versions wolfSSL versions 5.8.4 through 5.9.2 Description A failure in the X509 verify cert function allows an unverified attacker CA to be permanently stored in the shared CertManager. This leads to a bypass of certificate validation across all...

PT-2026-99517

Name of the Vulnerable Software and Affected Versions wolfSSL versions 5.3.0 through 5.9.2 Description When NO SESSION CACHE REF is undefined, the wolfSSL get session function returns a ClientSession reference to the process-global SessionCache instead of a session object. The...

CVE-2026-94419: Improper Authentication

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94418: Improper Verification of Cryptographic Signature

Under WOLFSSLSMALLCERTVERIFY, ProcessPeerCertParse runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signature result back only when the parse returned 0, so any parse error hid it. ParseCertRelative reaches its...

CVE-2026-93302: Improper Certificate Validation

MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSLTRUSTPEERCERT and load CA certificates with wolfSSLCTXtrustpeercert or wolfSSLtrustpeercert. The peer must know the certificates being loaded to...

CVE-2026-93304: Incorrect Behavior Order

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

CVE-2026-89102: Improper Certificate Validation

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...

CVE-2026-89133: Improper Certificate Validation

wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepted...

CVE-2026-89135: Improper Certificate Validation

A failed X509verifycert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer native TLS, OCSP, CRL, direct CM verify. This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros OPENSSLEXTRA &&...

Linux Distros Unpatched Vulnerability : CVE-2026-93302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSLTRUSTPEERCE...

Linux Distros Unpatched Vulnerability : CVE-2026-94418

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Under WOLFSSLSMALLCERTVERIFY, ProcessPeerCertParse runs the certificate signature check separately from the parse to keep peak memory down, then merges the two...

Linux Distros Unpatched Vulnerability : CVE-2026-15442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all builds that make use of DTLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a...

CVE-2026-94417: Improper Check for Certificate Revocation

When an application enables both OCSP and CRL revocation checking on one WOLFSSLCTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information Access OCSP URL, and accepts a certificate the loaded CRL lists as revoked. The soft-fail policy f...

CVE-2026-15442: Use After Free

In all builds that make use of DTLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use-after free. If an application ended up getting a partial wolfSSLread which is sometimes caused by a small user buffer passed in, then calle...

CVE-2026-82208

A flaw was found in libcurl when using the wolfSSL backend. When CA Certificate Authority caching is enabled and a CURLOPTSSLCTXFUNCTION callback is used to replace the trust store, libcurl can silently reinstall the cached store. This can lead to a scenario where a certificate that should be...

wolfCOSE v2.0.0

wolfCOSE wolfCOSE is a lightweight and fast C library implementing core CBOR and COSE standards, backed by wolfSSL for cryptography. Supported Standards & RFCs Core Specifications: RFC 8949 - Concise Binary Object Representation CBOR RFC 9052 - CBOR Object Signing and Encryption COSE RFC 9053 -...

Astra Linux – Vulnerability in curl

With the wolfSSL backend, when CA caching is enabled and a CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. This results in a certificate trusted by the cached store but rejected by the callback-selected store bei...