A critical cryptographic validation flaw in wolfSSL breaks trust across multiple signature algorithms, not just ECDSA. This means devices relying on wolfSSL for TLS certificate verification can accept forged certificates, enabling impersonation and man-in-the-middle attacks. The missing checks on hash size and OID allow attackers to bypass signature verification in embedded clients, gateways, and appliances.
The vulnerability, CVE-2026-5194, affects wolfSSL versions before 5.9.1 and impacts ECDSA/ECC, DSA, ML-DSA, Ed25519, and Ed448 signature schemes. wolfSSL is embedded in over 5 billion devices worldwide, including IoT, industrial control systems, automotive, aerospace, defense, and telecom equipment. This broad deployment amplifies the risk of widespread trust failures in critical infrastructure and embedded environments.
Because many affected devices are embedded and slow to update, the exposure to forged certificates will persist long after patches are released. This flaw undermines the fundamental assumption that TLS peer authentication is trustworthy, creating a lasting risk of server impersonation across diverse sectors.