Client-side Flaw in wolfSSL Leading to Certificate Forgery
CVE-2026-89102

8.3HIGH

Key Information:

Vendor

Wolfssl

Status
Wolfssl
Vendor
CVE Published:
27 September 2026

What is CVE-2026-89102?

In certain versions of wolfSSL, a significant flaw in the client-side implementation of RFC 6961, specifically regarding multiple OCSP response stapling, exists. This vulnerability permits a wolfSSL client, upon enabling OCSP stapling with the HAVE_CERTIFICATE_STATUS_REQUEST_V2 feature, to accept any certificate within the peer's chain as a certificate authority (CA). It lacks the necessary verification to confirm the authority's authenticity. Consequently, an attacker with a valid certificate that links to a trusted CA can forge certificates for any arbitrary identity, which the client will mistakenly validate. This issue is exacerbated on subsequent connections using the same context, affecting any future interactions even if OCSP multi usage is not utilized. The vulnerability was identified during internal testing by wolfSSL.

Affected Version(s)

wolfSSL 5.7.2 <= 5.9.2

References

https://github.com/wolfSSL/wolfssl/pull/11027

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.