CVE-2026-5194
EPSS 0.4% (37th percentile).
Vulnerabilities · 155 days ago
A critical cryptographic validation flaw in wolfSSL breaks trust across multiple signature algorithms, not just ECDSA. This means devices relying on wolfSSL for TLS certificate verification can accept forged certificates, enabling impersonation and man-in-the-middle attacks. The missing checks on hash size and OID allow attackers to bypass signature verification in embedded clients, gateways, and appliances.
The vulnerability, CVE-2026-5194, affects wolfSSL versions before 5.9.1 and impacts ECDSA/ECC, DSA, ML-DSA, Ed25519, and Ed448 signature schemes. wolfSSL is embedded in over 5 billion devices worldwide, including IoT, industrial control systems, automotive, aerospace, defense, and telecom equipment. This broad deployment amplifies the risk of widespread trust failures in critical infrastructure and embedded environments.
Because many affected devices are embedded and slow to update, the exposure to forged certificates will persist long after patches are released. This flaw undermines the fundamental assumption that TLS peer authentication is trustworthy, creating a lasting risk of server impersonation across diverse sectors.
EPSS 0.4% (37th percentile).
1 source covering this story
Critical flaw in wolfSSL library enables forged certificate use
A critical vulnerability in the wolfSSL SSL/TLS library can weaken security via improper verification of the hash algorithm or its size when checking Elliptic Curve Digital Signature Algorithm (ECDSA) signatures.
Part of the PlainSec briefing for 2026-04-13