CVE-2026-5772: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-5772 is a 1-byte stack buffer over-read vulnerability in the MatchDomainName function (src/internal.c) of wolfSSL, triggered during wildcard hostname validation when the LEFT_MOST_WILDCARD_ONLY flag is active. If a wildcard * character exhausts the entire hostname string, the function reads one byte past the end of the buffer without a bounds check, potentially causing a crash. All wolfSSL versions up to and including 5.9.0 are affected; the fix is included in version 5.9.2. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory, wolfSSL PR).

The root cause is classified as CWE-126 (Buffer Over-read): the MatchDomainName function's main loop does not verify that the remaining string length (strLen) is greater than zero before dereferencing the next character when a wildcard pattern has consumed the entire input hostname. This missing bounds check allows a one-byte read past the stack buffer boundary. The fix, merged April 3, 2026, adds a guard condition to exit the loop when either the pattern or string length reaches zero, preventing the out-of-bounds read (wolfSSL PR). The vulnerability was reported by Zou Dikai and tracked internally as zd#21512 (wolfSSL PR).

Successful exploitation results in a denial-of-service condition: the application using wolfSSL for TLS hostname validation may crash due to the invalid memory read. There is no impact on confidentiality or integrity, as the over-read is limited to a single byte and does not expose sensitive data or allow memory writes. The vulnerability affects any application that uses wolfSSL's wildcard hostname matching with the LEFT_MOST_WILDCARD_ONLY flag enabled during TLS certificate validation (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.042–0.046%, placing it in the 15th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires specific preconditions: the attacker must be able to influence the hostname or certificate subject being validated, and the target application must have the LEFT_MOST_WILDCARD_ONLY flag active (GitHub Advisory).

Upgrade wolfSSL to version 5.9.2 or later, which includes the fix merged on April 3, 2026 (wolfSSL PR). For embedded or downstream distributions (e.g., OpenEmbedded/meta-openembedded), backport patches referencing PR #10119 are available as of May 2026. As a configuration-level workaround, applications can avoid enabling the LEFT_MOST_WILDCARD_ONLY flag in hostname validation until the upgrade is applied. Additionally, implement input validation to ensure hostname strings passed to wolfSSL are properly formed before processing.

The vulnerability was disclosed via the oss-security mailing list in Q2 2026 and received routine coverage from vulnerability tracking services including Tenable (Nessus plugin 305900) and VulDB (oss-sec). No significant vendor statements beyond the wolfSSL patch or notable researcher commentary have been identified. Community reaction has been minimal, consistent with the low severity and limited exploitability of the issue.