Public Key Processing Flaw in wolfSSL Affects Raw Public Key Support

CVE-2026-55960

What is CVE-2026-55960?

A vulnerability exists in wolfSSL where an un-negotiated Raw Public Key can be accepted in lieu of an X.509 certificate, circumventing necessary chain validation. The absence of a certificate chain in a raw public key allows the ParseCertRelative() function to accept it without conducting trust verification. It is crucial that raw public keys are only accepted when explicitly negotiated. The vulnerability specifically impacts builds with Raw Public Key support enabled (HAVE_RPK), which is off by default in standalone builds but can be enabled through --enable-all. The recent updates to wolfSSL ensure that the system defaults to expecting an X.509 certificate type when no type has been negotiated, thereby preventing un-negotiated raw public keys from being accepted.

References