CVE-2026-5501 Improper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates
Attackers can bypass certificate validation in wolfSSL's OpenSSL compatibility layer to forge certificates, affecting applications using this specific API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5501?
CVE-2026-5501 is a high-severity vulnerability in Wolfssl Wolfssl, published on 10 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
wolfSSL_X509_verify_cert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies an untrusted intermediate with Basic Constraints `CA:FALSE` that is legitimately signed by a trusted root. An attacker who obtains any leaf certificate from a trusted CA (e.g. a free DV cert from Let's Encrypt) can forge a certificate for any subject name with any public key and arbitrary signature bytes, and the function returns `WOLFSSL_SUCCESS` / `X509_V_OK`. The native wolfSSL TLS handshake path (`ProcessPeerCerts`) is not susceptible and the issue is limited to applications using the OpenSSL compatibility API directly, which would include integrations of wolfSSL into nginx and haproxy.
Weakness: CWE-295
Which versions are affected by CVE-2026-5501?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2026-5501?
Apply the vendor's patch.
Is CVE-2026-5501 being exploited?
There is no known exploitation of CVE-2026-5501 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2026-5501, GHSA-hg75-4cmp-f367, JLSEC-2026-730, UBUNTU-CVE-2026-5501.