CVE-2026-5194 wolfSSL ECDSA Certificate Verification
wolfSSL accepts weak ECDSA certificate signatures due to missing size checks, potentially bypassing authentication if specific algorithms are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5194?
CVE-2026-5194 is a critical vulnerability in Wolfssl Wolfssl, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA certificate-based authentication if the public CA key used is also known. This affects ECDSA/ECC verification when EdDSA or ML-DSA is also enabled.
Weakness: CWE-295
Which versions are affected by CVE-2026-5194?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2026-5194?
Apply the vendor's patch.
Is CVE-2026-5194 being exploited?
There is no known exploitation of CVE-2026-5194 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2026-5194, GHSA-f5h9-5q52-qrx7, JLSEC-2026-716, UBUNTU-CVE-2026-5194.