CVE-2026-94418

Name of the Vulnerable Software and Affected Versions wolfSSL (affected versions not specified)

Description When the WOLFSSL SMALL CERT VERIFY option is enabled, the ProcessPeerCertParse() function executes the certificate signature check separately from the parsing process to reduce peak memory usage. However, the signature result is only merged back if the parse returns 0, meaning any parse error hides the signature result. This inverts the precedence of checks in ParseCertRelative(), where validity-date, name-constraint, and critical-extension checks normally occur only after ConfirmSignature() passes. Consequently, the ASN SIG CONFIRM E error is never surfaced.

An attacker can exploit this by using a self-made certificate with the expected subject name, the trusted CA's subject as the issuer, arbitrary bytes for the signature, a validity window in the past, and their own key pair. This allows the bypass of PKI requirements without needing CA compromise. The issue affects TLS 1.2, TLS 1.3, and DTLS. If a forged chain certificate is accepted via a verify callback that overrides date errors (such as myVerify() in wolfssl/test.h), the certificate may be cached in the WOLFSSL CTX certificate manager.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

As a temporary mitigation, avoid enabling WOLFSSL SMALL CERT VERIFY via autotools options such as --enable-lowresource, --enable-leantls, --enable-tinytls13=cert, or --enable-tinytls13=mutualauth.

Ensure that verify callbacks installed through wolfSSL CTX set verify() or wolfSSL set verify() do not return 1 for ASN BEFORE DATE E or ASN AFTER DATE E when WOLFSSL VERIFY PEER is used.

If a system has been exposed to forged certificates, restart the context or the process to clear the WOLFSSL CTX certificate manager cache.