PT-2026-31721 · Wolfssl · Wolfssl

Nicholas Carlini · Published 2026-04-07 · Updated 2026-05-26 · CVE-2026-5194

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 5.9.1

Description Missing hash/digest size and Object Identifier (OID) checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than appropriate for the relevant key type, to be accepted by signature verification functions. This flaw enables the acceptance of forged digital identities, potentially allowing a malicious server, file, or connection to be trusted. The issue affects ECDSA/ECC verification when EdDSA or ML-DSA is also enabled, specifically impacting the library's handling of signatures in ECDSA, DSA, ML-DSA, Ed25519, and Ed448. It is estimated that over 5 billion devices worldwide are potentially affected, including embedded systems, IoT devices, routers, automotive systems, power grid infrastructure, and military systems.

Recommendations Update to version 5.9.1.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2026-05269

CVE-2026-5194

Affected Products

Wolfssl

References · 48

• https://github.com/wolfSSL/wolfssl/pull/10131 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5194 · Security Note
• https://bdu.fstec.ru/vul/2026-05269 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-5194 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5194 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5194 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5194 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5194 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl/releases · Note
• https://twitter.com/YourAnon_irc/status/2058989564191035417 · Twitter Post
• https://twitter.com/fynn_JourX/status/2043988902298693886 · Twitter Post
• https://twitter.com/blueteamsec1/status/2054222101368999943 · Twitter Post
• https://twitter.com/SecureChap/status/2043843080726438032 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2043841281353232840 · Twitter Post
• https://twitter.com/0dayPublishing/status/2042334165245292901 · Twitter Post