CVE-2026-5466 wc_VerifyEccsiHash missing sanity check

What is CVE-2026-5466?

CVE-2026-5466 is a high-severity vulnerability in Wolfssl Wolfssl, published on 10 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r` and `s` scalars from the signature blob via `mp_read_unsigned_bin` with no check that they lie in `[1, q-1]`. A crafted forged signature could verify against any message for any identity, using only publicly-known constants.

Weakness: CWE-347

Which versions are affected by CVE-2026-5466?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2026-5466?

Apply the vendor's patch.

Is CVE-2026-5466 being exploited?

There is no known exploitation of CVE-2026-5466 in the wild and no public exploit code.

Other vulnerabilities in Wolfssl Wolfssl

• CVE-2024-5991 Buffer overread in domain name matching Critical 10.0
• CVE-2021-37155 Security feature bypass in n/a Critical 9.8
• CVE-2020-36177 Memory corruption in n/a Critical 9.8
• CVE-2014-2896 Memory corruption in n/a Critical 9.8
• CVE-2014-2897 Memory corruption in n/a Critical 9.8

All Wolfssl Wolfssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-5466, GHSA-47qf-hp3h-rwmm, JLSEC-2026-726, UBUNTU-CVE-2026-5466.