CVE-2026-5188 Integer underflow in X.509 SAN parsing in wolfSSL
An integer underflow in wolfSSL's optional ASN.1 parser allows incorrect handling of malformed X.509 certificates, potentially leading to undefined behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-5188?
CVE-2026-5188 is a low-severity vulnerability in Wolfssl Wolfssl, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can specify an entry length larger than the enclosing sequence, causing the internal length counter to wrap during parsing. This results in incorrect handling of certificate data. The issue is limited to configurations using the original ASN.1 parsing implementation which is off by default.
Weakness: CWE-191
Which versions are affected by CVE-2026-5188?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2026-5188?
Apply the vendor's patch.
Is CVE-2026-5188 being exploited?
There is no known exploitation of CVE-2026-5188 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2026-5188, GHSA-9qgc-pcpx-g38q, JLSEC-2026-715, UBUNTU-CVE-2026-5188.