Vulnerability · Published Mar 19, 2026 · Assigned by wolfSSL
CVE-2026-3229Integer Overflow in Certificate Chain Allocation
Low 1.2
In plain English
A low-severity heap buffer overflow in wolfSSL from wofSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An integer overflow vulnerability existed in the static function wolfssl_add_to_chain, that caused heap corruption when certificate data was written out of bounds of an insufficiently sized certificate buffer. wolfssl_add_to_chain is called by these API: wolfSSL_CTX_add_extra_chain_cert, wolfSSL_CTX_add1_chain_cert, wolfSSL_add0_chain_cert. These API are enabled for 3rd party compatibility features: enable-opensslall, enable-opensslextra, enable-lighty, enable-stunnel, enable-nginx, enable-haproxy. This issue is not remotely exploitable, and would require that the application context loading certificates is compromised.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | wolfssl | 5.9.1-r0 | ALPINE-CVE-2026-3229 |
| Alpine:v3.24 | wolfssl | 5.9.0-r0 | ALPINE-CVE-2026-3229 |
| Debian:12 | wolfssl | no fix listed | DEBIAN-CVE-2026-3229 |
| Debian:13 | wolfssl | no fix listed | DEBIAN-CVE-2026-3229 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-3229 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-3229 |
| Ubuntu:25.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-3229 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-3229 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green