CVE-2026-89102

Name of the Vulnerable Software and Affected Versions wolfSSL versions 5.7.2 through 5.9.2 Apache Tomcat versions prior to 10.1.34

Description wolfSSL contains a client-side implementation flaw in RFC 6961 regarding multiple OCSP response stapling. When the HAVE CERTIFICATE STATUS REQUEST V2 feature is enabled and the wolfSSL UseOCSPStaplingV2() function is called with the WOLFSSL CSR2 OCSP MULTI option, the client accepts any certificate in the peer's chain as a certificate authority without proper verification. This allows an attacker with a valid certificate and private key chaining to a trusted CA to forge certificates for arbitrary identities. The server's end entity certificate is stored in the persistent trust store, which affects subsequent connections reusing the context.

Apache Tomcat is affected by a deserialization flaw that allows unauthenticated attackers to execute arbitrary code on the server by sending a single crafted request. This issue potentially impacts thousands of Java web applications worldwide.

Recommendations For wolfSSL versions 5.7.2 through 5.9.2, avoid using the wolfSSL UseOCSPStaplingV2() function with the WOLFSSL CSR2 OCSP MULTI option. For Apache Tomcat versions prior to 10.1.34, upgrade to version 10.1.34 or a later patched release and restart the service.