Vulnerability · Published Apr 10, 2026 · Assigned by wolfSSL
CVE-2026-5501Improper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates
High 8.6
In plain English
A high-severity improper certificate validation in wolfSSL from wolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
wolfSSL_X509_verify_cert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies an untrusted intermediate with Basic Constraints `CA:FALSE` that is legitimately signed by a trusted root. An attacker who obtains any leaf certificate from a trusted CA (e.g. a free DV cert from Let's Encrypt) can forge a certificate for any subject name with any public key and arbitrary signature bytes, and the function returns `WOLFSSL_SUCCESS` / `X509_V_OK`. The native wolfSSL TLS handshake path (`ProcessPeerCerts`) is not susceptible and the issue is limited to applications using the OpenSSL compatibility API directly, which would include integrations of wolfSSL into nginx and haproxy.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | wolfssl | 5.9.1-r0 | ALPINE-CVE-2026-5501 |
| Alpine:v3.24 | wolfssl | 5.9.1-r0 | ALPINE-CVE-2026-5501 |
| Debian:12 | wolfssl | no fix listed | DEBIAN-CVE-2026-5501 |
| Debian:13 | wolfssl | no fix listed | DEBIAN-CVE-2026-5501 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5501 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5501 |
| Ubuntu:25.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-5501 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-5501 |
| Ubuntu:26.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-5501 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N