wolfSSL up to 5.9.1 certificate validation

Summaryinfo

A vulnerability marked as problematic has been reported in wolfSSL up to 5.9.1. This issue affects some unknown processing. This manipulation causes certificate validation. This vulnerability appears as CVE-2026-55964. The attack may be initiated remotely. There is no available exploit. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in wolfSSL up to 5.9.1. It has been declared as problematic. Affected by this vulnerability is an unknown code. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect integrity. The summary by CVE is:

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key Usage extension is present, but chain-supplied temporary CAs (WOLFSSL_TEMP_CA) added while building a certificate path were previously exempted from this check, so an intermediate asserting CA:TRUE but lacking keyCertSign was accepted as a signing CA. The check now applies to chain-supplied temporary CAs as well; only operator-loaded root certificates (WOLFSSL_USER_CA) and self-signed roots remain exempt. Per RFC 5280 an absent Key Usage extension implies all usages, so the requirement is enforced only when the extension is actually present (extKeyUsageSet). Affects the OpenSSL-compatibility certificate-path-building path (X509_verify_cert / X509_STORE, OPENSSL_EXTRA/OPENSSL_ALL), where untrusted chain intermediates are added as temporary CAs; native (non-OpenSSL-compat) certificate verification does not create temporary CAs and is unaffected. Within those builds, the check applies unless ALLOW_INVALID_CERTSIGN is defined.

The weakness was presented by Nvidia Project Vanessa. The advisory is shared at github.com. This vulnerability is known as CVE-2026-55964 since 06/18/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1587.003 for this issue.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• wolfSSL

Version

• 5.9.0
• 5.9.1

License

• open-source

Website

• Product: https://github.com/wolfSSL/wolfssl/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion