PT-2026-52526 · Wolfssl · Wolfssl

Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-55961

Mitre

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

wolfSSL PKCS7 verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibility-layer verify path now rejects the object when no signer signature has actually been verified, so a PKCS#7 carrying no valid signature is no longer reported as verified. This is enforced regardless of the PKCS7 NOVERIFY flag, which only suppresses signer certificate chain validation and was never intended to waive the requirement that a signature exist. Only affects OpenSSL compatibility builds that call the PKCS7 verify() compatibility API on potentially degenerate PKCS#7 bundles.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2026-55961

Produtos afetados

Wolfssl

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-55961 · Nota de Segurança
• https://github.com/wolfSSL/wolfssl/pull/10702 · Correção
• https://wolfssl.com/docs/security-vulnerabilities · Nota