Vulnerability in WolfSSL's Certificate Verification Process

CVE-2026-94418

What is CVE-2026-94418?

A vulnerability exists in the wolfSSL library relating to its certificate signature verification process. When the WOLFSSL_SMALL_CERT_VERIFY option is enabled, the signature check is performed separately from the parsing of the certificate. This design choice can mask signature verification failures when a parsing error occurs. If an attacker creates a self-signed certificate with an expected subject name but misleading validity dates, they can bypass signature checks and compromise secure connections. This issue is particularly concerning for applications that do not implement adequate verification callbacks, resulting in potential exposure to man-in-the-middle attacks, especially when using TLS and DTLS protocols. Proper measures must be taken to ensure this vulnerability is mitigated in affected deployments.

References