CVE-2026-5194
EPSS 0.3% (18º percentile).
Vulnerabilità · 169 giorni fa
A critical cryptographic validation flaw in wolfSSL breaks trust across multiple signature algorithms, not just ECDSA. This means devices relying on wolfSSL for TLS certificate verification can accept forged certificates, enabling impersonation and man-in-the-middle attacks. The missing checks on hash size and OID allow attackers to bypass signature verification in embedded clients, gateways, and appliances.
The vulnerability, CVE-2026-5194, affects wolfSSL versions before 5.9.1 and impacts ECDSA/ECC, DSA, ML-DSA, Ed25519, and Ed448 signature schemes. wolfSSL is embedded in over 5 billion devices worldwide, including IoT, industrial control systems, automotive, aerospace, defense, and telecom equipment. This broad deployment amplifies the risk of widespread trust failures in critical infrastructure and embedded environments.
Because many affected devices are embedded and slow to update, the exposure to forged certificates will persist long after patches are released. This flaw undermines the fundamental assumption that TLS peer authentication is trustworthy, creating a lasting risk of server impersonation across diverse sectors.
EPSS 0.3% (18º percentile).
1 fonte che coprono questa storia
Critical flaw in wolfSSL library enables forged certificate use
A critical vulnerability in the wolfSSL SSL/TLS library can weaken security via improper verification of the hash algorithm or its size when checking Elliptic Curve Digital Signature Algorithm (ECDSA) signatures.
Part of the PlainSec briefing for 2026-04-13