PT-2026-52590 · Wolfssl · Wolfssl

Kim Youngjoon · Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-10098

Mitre

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

OCSP CertID serial-number length-confusion in wolfSSL OCSP resp find status allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared serial-number bytes without first requiring the two serial numbers to be of equal length, so a SingleResponse for one certificate (same issuer) whose serial is a prefix of the target's serial would match, returning the wrong certificate's status. The fix requires the serial lengths to be equal before comparing the serial bytes.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-10098

Produtos afetados

Wolfssl

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-10098 · Nota de Segurança
• https://github.com/wolfSSL/wolfssl/pull/10554 · Correção
• https://wolfssl.com/docs/security-vulnerabilities · Nota