Vulnerability · Published Jun 25, 2026 · Assigned by wolfSSL
CVE-2026-10098OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status
Medium 6.3
In plain English
A medium-severity improper certificate validation in wolfSSL from wolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared serial-number bytes without first requiring the two serial numbers to be of equal length, so a SingleResponse for one certificate (same issuer) whose serial is a prefix of the target's serial would match, returning the wrong certificate's status. The fix requires the serial lengths to be equal before comparing the serial bytes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | wolfssl | 5.9.2-r0 | ALPINE-CVE-2026-10098 |
| Debian:12 | wolfssl | no fix listed | DEBIAN-CVE-2026-10098 |
| Debian:13 | wolfssl | no fix listed | DEBIAN-CVE-2026-10098 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-10098 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-10098 |
| Ubuntu:25.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-10098 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-10098 |
| Ubuntu:26.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-10098 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N