Vulnerability · Published Apr 10, 2026 · Assigned by wolfSSL
CVE-2026-5188Integer underflow in X.509 SAN parsing in wolfSSL
Low 2.3
In plain English
A low-severity security flaw in wolfSSL from wolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can specify an entry length larger than the enclosing sequence, causing the internal length counter to wrap during parsing. This results in incorrect handling of certificate data. The issue is limited to configurations using the original ASN.1 parsing implementation which is off by default.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | wolfssl | 5.9.1-r0 | ALPINE-CVE-2026-5188 |
| Alpine:v3.24 | wolfssl | 5.9.1-r0 | ALPINE-CVE-2026-5188 |
| Debian:12 | wolfssl | no fix listed | DEBIAN-CVE-2026-5188 |
| Debian:13 | wolfssl | no fix listed | DEBIAN-CVE-2026-5188 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5188 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5188 |
| Ubuntu:25.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-5188 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5188 |
| Ubuntu:26.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-5188 |
Affected products (as reported)
Weakness: CWE-191 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N