CRL and OCSP Vulnerability in wolfSSL Products from wolfSSL

CVE-2026-94417

What is CVE-2026-94417?

The vulnerability occurs in wolfSSL when both OCSP and CRL revocation checking are enabled. In scenarios lacking an Authority Information Access OCSP URL, wolfSSL may neglect the CRL check for peer certificates, incorrectly accepting revoked certificates. This flaw arises from a soft-fail policy that misinterprets the absence of a responder as a successful response, allowing unverified certificates into trusted states. This issue affects any application using wolfSSL configured to utilize both OCSP and CRL checking, facilitating potential security risks during TLS 1.0 to 1.3 and DTLS communication. It is crucial for users of affected versions to not only update their library but also to dismantle and recreate their WOLFSSL_CTX context to mitigate these risks.

References