CVE-2026-5194: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-5194 is a critical improper certificate validation vulnerability in the wolfSSL cryptographic library that allows ECDSA certificate signature forgery via undersized digests. Missing hash/digest size and OID checks in signature verification functions permit digests smaller than allowed — or smaller than appropriate for the relevant key type — to be accepted, enabling authentication bypass when the public CA key is known. The vulnerability affects wolfSSL versions 3.12.0 through 5.9.0 (fixed in 5.9.1) and is specifically triggered when ECDSA/ECC verification is used alongside EdDSA or ML-DSA. It carries a CVSS v3.1 score of 9.1 (Critical) and a CVSS v4.0 score of 9.3 (Critical) (GitHub Advisory, Red Hat Bugzilla). The vulnerability was published on April 9, 2026, and a patch was merged into the wolfSSL master branch on April 6, 2026 (wolfSSL PR #10131).

The root cause is classified as CWE-295 (Improper Certificate Validation): wolfSSL's ECDSA/ECC signature verification functions failed to enforce minimum digest size requirements and did not validate that the hash algorithm OID matched the key type being used (GitHub Advisory). This flaw is specifically present when EdDSA or ML-DSA is also enabled in the build, creating a code path where undersized digests bypass the expected validation logic. The fix, implemented in PR #10131, added a SigOidMatchesKeyOid() helper function, a WC_MIN_DIGEST_SIZE macro, and additional size and OID agreement checks across signature generation and verification operations in wolfcrypt/src/signature.c, asn.c, ed448.c, dilithium.c, and src/pk_ec.c (wolfSSL PR #10131). The attack maps to CAPEC-475 (Signature Spoofing by Improper Validation) and CAPEC-459 (Creating a Rogue Certification Authority Certificate). A network-accessible attacker with low privileges who knows the public CA key can craft a certificate with a truncated digest that passes verification.

Successful exploitation allows an unauthenticated or low-privileged network attacker to forge ECDSA certificate signatures using undersized digests, effectively bypassing certificate-based authentication in any system relying on wolfSSL for TLS/DTLS or other PKI operations (GitHub Advisory). The confidentiality and integrity impacts are both rated High, as an attacker could impersonate trusted entities, intercept encrypted communications, or gain unauthorized access to systems protected by ECDSA certificate authentication. wolfSSL is widely embedded in IoT devices, routers, automotive systems, and military/industrial platforms, meaning the attack surface spans billions of devices (BleepingComputer, HackRead). Availability impact is assessed as Low, with no direct denial-of-service consequence from exploitation itself.

As of the time of disclosure, there is no public proof-of-concept exploit code and no confirmed in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.035% (0.000350), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported. However, the precondition of knowing the public CA key is achievable in many real-world scenarios (e.g., public CAs, self-signed certificates in IoT deployments), and the network-accessible, no-user-interaction attack vector makes this a high-priority patching target despite the current lack of weaponized exploits.

1. Reconnaissance: Identify systems using wolfSSL versions 3.12.0–5.9.0 for TLS/DTLS or certificate-based authentication, particularly IoT devices, embedded systems, or VPN endpoints. Tools like Shodan or Censys can fingerprint wolfSSL-based services.
2. Obtain the public CA key: Retrieve the public CA certificate used by the target system. In many deployments (public CAs, self-signed IoT certs), this is publicly accessible or can be obtained during a normal TLS handshake.
3. Craft a malicious certificate: Construct a forged X.509 certificate with an ECDSA signature computed over a digest that is smaller than the minimum required size (e.g., a truncated hash), exploiting the missing WC_MIN_DIGEST_SIZE enforcement.
4. Ensure EdDSA or ML-DSA is enabled: The vulnerability is only triggered when the target wolfSSL build includes EdDSA or ML-DSA support alongside ECDSA/ECC, so confirm the target's build configuration if possible.
5. Present the forged certificate: Initiate a TLS/DTLS handshake or authentication session with the target, presenting the crafted certificate. The vulnerable wolfSSL signature verification function accepts the undersized digest without rejecting it.
6. Achieve authentication bypass: The target system accepts the forged certificate as valid, granting the attacker access as the impersonated identity, enabling man-in-the-middle attacks, unauthorized access, or further lateral movement (GitHub Advisory, wolfSSL PR #10131).

• Network: Unexpected or anomalous TLS/DTLS handshakes from unknown clients presenting ECDSA certificates; certificate chains with unusually short digest values in signature fields; connections from IPs not matching expected client ranges.
• Logs: TLS handshake logs showing successful certificate validation for certificates with non-standard or truncated hash sizes; authentication success events for unexpected or unknown certificate subjects/issuers.
• File System: Presence of unexpected CA certificates or forged certificate files on endpoints; newly introduced certificates in trust stores not matching known-good baselines.
• Process/Application: wolfSSL-linked applications accepting certificates that fail validation under updated library versions; anomalous authentication events in services using ECDSA certificate-based mutual TLS.

The primary remediation is to upgrade wolfSSL to version 5.9.1 or later, which includes the fix merged in PR #10131 adding proper digest size and OID enforcement (wolfSSL PR #10131, GitHub Advisory). wolfSSL has also published specific guidance for FIPS customers who make direct calls to wc_ecc_verify_hash(), advising them to audit those call sites for compliance with the new digest size requirements (wolfSSL FIPS Guidance). If immediate patching is not possible, restrict network access to systems relying on ECDSA certificate verification, implement additional authentication layers (e.g., multi-factor authentication), and monitor certificate validation logs for suspicious patterns. Organizations should also review any custom code that calls wolfSSL's ECC verification APIs directly to ensure digest sizes are validated before passing to library functions.

BleepingComputer reported on the vulnerability under the headline "Critical flaw in wolfSSL library enables forged certificate use," highlighting the broad device impact (BleepingComputer). HackRead framed the issue as affecting "IoT routers and military systems," emphasizing the embedded systems risk (HackRead). The vulnerability was discussed on the oss-security mailing list and picked up by the r/blueteamsec subreddit and Bluesky security community shortly after disclosure. Heise.de covered it in German-language security media, and it was included in The Hacker News weekly recap. wolfSSL published vendor-specific guidance for FIPS customers, indicating proactive vendor engagement with the security community (wolfSSL FIPS Guidance). The VulnCheck blog noted the CVE in the context of Anthropic's Project Glasswing AI-assisted vulnerability discovery program, which was credited with finding this and related issues (VulnCheck Blog).