Vulnerability · Published Apr 9, 2026 · Assigned by wolfSSL
CVE-2026-5194wolfSSL ECDSA Certificate Verification
Critical 9.3
In plain English
A critical-severity improper certificate validation in wolfSSL from wolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA certificate-based authentication if the public CA key used is also known. This affects ECDSA/ECC verification when EdDSA or ML-DSA is also enabled.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | wolfssl | 5.9.1-r0 | ALPINE-CVE-2026-5194 |
| Alpine:v3.24 | wolfssl | 5.9.1-r0 | ALPINE-CVE-2026-5194 |
| Debian:12 | wolfssl | 5.5.4-2+deb12u3 | DEBIAN-CVE-2026-5194 |
| Debian:13 | wolfssl | 5.7.2-0.1+deb13u2 | DEBIAN-CVE-2026-5194 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5194 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5194 |
| Ubuntu:25.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-5194 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5194 |
| Ubuntu:26.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-5194 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:L/SA:L/U:Red