CVE-2026-55964

Name of the Vulnerable Software and Affected Versions wolfSSL (affected versions not specified)

Description An issue exists where chain intermediate certificates asserting CA:TRUE but lacking the keyCertSign key usage were accepted as signing CAs. This occurs because chain-supplied temporary CAs (WOLFSSL TEMP CA) added during certificate path building were previously exempt from the requirement that intermediate CA certificates must have keyCertSign when a Key Usage extension is present. This behavior affects the OpenSSL-compatibility certificate-path-building path, specifically involving the X509 verify cert() and X509 STORE functions when OPENSSL EXTRA or OPENSSL ALL are used. Native certificate verification is not affected as it does not create temporary CAs. According to RFC 5280, the requirement is only enforced when the extKeyUsageSet extension is actually present, as an absent Key Usage extension implies all usages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Define ALLOW INVALID CERTSIGN within the affected builds to bypass the check. Restrict the use of the X509 verify cert() and X509 STORE functions in OpenSSL-compatibility paths to minimize risk.