PKCS#7 Verification Flaw in wolfSSL Affects OpenSSL Compatibility Builds

CVE-2026-55961

What is CVE-2026-55961?

The wolfSSL library contains a vulnerability where the function wolfSSL_PKCS7_verify() incorrectly validates certain degenerate PKCS#7 objects, specifically those without any associated signer. This flaw allows an empty signerInfos structure to be treated as verified, despite the absence of any legitimate signature. Consequently, the verification process may wrongly indicate that data has been authentically signed. The recent patch enforces stricter checks to reject PKCS#7 objects lacking valid signatures, enhancing security by ensuring that verification is contingent upon the presence of a real signature, regardless of any associated flags. This vulnerability primarily affects OpenSSL compatibility builds utilizing the PKCS7_verify() compatibility API.

References