Signature Validation Bypass in wolfSSL Affecting OpenSSL Integrations

CVE-2026-5501

What is CVE-2026-5501?

The wolfSSL library's OpenSSL compatibility layer is vulnerable to a certificate signature validation bypass. This vulnerability occurs when the wolfSSL_X509_verify_cert function accepts a certificate chain where the leaf certificate's signature is not adequately verified. An attacker can exploit this flaw by providing an untrusted intermediate certificate that possesses Basic Constraints set to 'CA:FALSE' and is signed by a trusted root certificate. This allows the attacker to forge a valid certificate for any subject name using any public key, undermining the integrity of secure connections using wolfSSL in applications that rely on the OpenSSL compatibility API, such as nginx and haproxy.

References