Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-10098: wolfSSL may report wrong revocation status for some certificates

CVE-2026-10098 · published 4 months ago

Summary

The wolfSSL library can mistakenly give the revocation status of one certificate when checking another if the two certificates share the same issuer and one serial number starts with the other. This could cause systems to think a valid certificate is revoked or a revoked one is still trusted, affecting any service that uses wolfSSL for secure connections. Update to the latest wolfSSL version that adds a length check before comparing serial numbers.

What to do

Update wolfssl wolfssl to version 5.9.2 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	wolfssl	wolfssl	>= 4.6.0, < 5.9.2 `cpe:2.3:a:wolfssl:wolfssl::::::::`
Debian:11	debian	wolfssl	All versions
Debian:12	debian	wolfssl	All versions
Debian:13	debian	wolfssl	All versions
Ubuntu:16.04:LTS	canonical	wolfssl	All versions

Original advisory text

OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status

OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared serial-number bytes without first requiring the two serial numbers to be of equal length, so a SingleResponse for one certificate (same issuer) whose serial is a prefix of the target's serial would match, returning the wrong certificate's status. The fix requires the serial lengths to be equal before comparing the serial bytes.

References

https://github.com/wolfSSL/wolfssl/pull/10554 Third Party Advisory
https://www.wolfssl.com/docs/security-vulnerabilities/ Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-10098 Vendor Advisory
https://ubuntu.com/security/CVE-2026-10098 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-10098 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10098... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-10098 Vendor Advisory
https://github.com/wolfSSL/wolfssl Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-295Improper Certificate Validation

Timeline

Published25 Jun 2026

Updated30 Oct 2026

First seen25 Jun 2026

Sources

CVE-2026-10098 · NVD

DEBIAN-CVE-2026-10098 · OSV

UBUNTU-CVE-2026-10098 · OSV

CVE-2026-10098 · OSV

Track software like this

Free during beta