Signature Verification Flaw in wolfSSL's ECCSI Component

CVE-2026-5466

What is CVE-2026-5466?

The vulnerability in wolfSSL's ECCSI signature verifier's wc_VerifyEccsiHash function allows an attacker to create a forged signature that can be incorrectly validated against any message for any identity, undermining the integrity and trust in cryptographic operations. This is achieved by exploiting the lack of bounds checking on the decoded r and s scalars, which should be validated to ensure they fall within the range of [1, q-1]. As a result, the affected versions of wolfSSL are susceptible to potential misuse, highlighting the need for prompt remediation and enhanced security measures.

References