CVE-2026-11999

Name of the Vulnerable Software and Affected Versions wolfSSL (affected versions not specified)

Description A trust-chain bypass exists in the OpenSSL compatibility certificate verifier function wolfSSL X509 verify cert(). This issue occurs in builds configured with --enable-opensslextra when an application calls X509 verify cert() using untrusted intermediates provided by the caller. The function may return success based solely on the last verified link instead of confirming that a trust anchor was reached. Specifically, if the supplied certificate chain exceeds the verifier's maximum path depth (defaulting to 100), the path building process exhausts its depth while still processing untrusted intermediates, leading to the acceptance of an attacker-controlled certificate.

Recommendations Restrict the use of the wolfSSL X509 verify cert() function when handling caller-supplied untrusted intermediates until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.