Missing Hash Size and OID Checks in wolfSSL's ECDSA Verification

CVE-2026-5194

What is CVE-2026-5194?

This vulnerability in wolfSSL arises from inadequate hash size and Object Identifier (OID) checks during ECDSA certificate verification. Attackers can exploit this flaw to bypass security measures, allowing digests smaller than permissible for the specified key type to be accepted by signature verification functions. If the public Certificate Authority (CA) key is known, this could significantly weaken the security posture of ECDSA certificate-based authentication, particularly in environments where EdDSA or ML-DSA are enabled.

References