PT-2026-52573 · Wolfssl · Wolfssl

Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-55964

Mitre

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key Usage extension is present, but chain-supplied temporary CAs (WOLFSSL TEMP CA) added while building a certificate path were previously exempted from this check, so an intermediate asserting CA:TRUE but lacking keyCertSign was accepted as a signing CA. The check now applies to chain-supplied temporary CAs as well; only operator-loaded root certificates (WOLFSSL USER CA) and self-signed roots remain exempt. Per RFC 5280 an absent Key Usage extension implies all usages, so the requirement is enforced only when the extension is actually present (extKeyUsageSet). Affects the OpenSSL-compatibility certificate-path-building path (X509 verify cert / X509 STORE, OPENSSL EXTRA/OPENSSL ALL), where untrusted chain intermediates are added as temporary CAs; native (non-OpenSSL-compat) certificate verification does not create temporary CAs and is unaffected. Within those builds, the check applies unless ALLOW INVALID CERTSIGN is defined.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-55964

Produtos afetados

Wolfssl

Referências · 3

• https://github.com/wolfSSL/wolfssl/pull/10702 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-55964 · Nota de Segurança
• https://wolfssl.com/docs/security-vulnerabilities · Nota