Vulnerability · Published Jun 25, 2026 · Assigned by wolfSSL
CVE-2026-6450CRL critical extension bypass in ParseCRL_Extensions
Low 1.0
In plain English
A low-severity improper certificate validation in wolfSSL from wolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A CRL critical extension bypass exists in ParseCRL_Extensions where critical extensions are not properly enforced, allowing a crafted CRL with an unhandled critical extension to be accepted. This only affects builds with CRL support enabled and where a crafted CRL had a trusted signature when parsed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | wolfssl | 5.9.2-r0 | ALPINE-CVE-2026-6450 |
| Debian:12 | wolfssl | 5.5.4-2+deb12u3 | DEBIAN-CVE-2026-6450 |
| Debian:13 | wolfssl | 5.7.2-0.1+deb13u2 | DEBIAN-CVE-2026-6450 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-6450 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-6450 |
| Ubuntu:25.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-6450 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-6450 |
| Ubuntu:26.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-6450 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N