EUVD-2026-39578
GHSA-xpv9-p7vg-qhrc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High complexity because exploitation requires both MITM/rogue-responder position and a specifically crafted prefix-serial certificate; no confidentiality or availability impact applies.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
2DescriptionCVE.org
OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared serial-number bytes without first requiring the two serial numbers to be of equal length, so a SingleResponse for one certificate (same issuer) whose serial is a prefix of the target's serial would match, returning the wrong certificate's status. The fix requires the serial lengths to be equal before comparing the serial bytes.
AnalysisAI
OCSP certificate status lookup in wolfSSL returns the wrong certificate's revocation status when a same-issuer SingleResponse serial number is a byte-prefix of the requested certificate's serial. The wolfSSL_OCSP_resp_find_status function in src/ocsp.c compared serial bytes via XMEMCMP without first verifying that both serial lengths are equal, allowing a 2-byte serial 01:02 in an OCSP response to satisfy a lookup for a 3-byte certificate serial 01:02:03. No public exploit has been identified at time of analysis, but the integrity consequence is concrete: a revoked certificate could be incorrectly reported as valid if an attacker can supply a crafted OCSP response.
Technical ContextAI
wolfSSL is a lightweight embedded SSL/TLS library targeting IoT, RTOS, and resource-constrained environments (CPE: cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*). OCSP (Online Certificate Status Protocol) enables certificate revocation checking by querying a responder for a CertID containing issuer hash, issuer key hash, and certificate serial number. The affected function wolfSSL_OCSP_resp_find_status iterated OCSP BasicResponse entries and matched a SingleResponse to the requested CertID by comparing issuer hashes and then calling XMEMCMP on the serial bytes. CWE-295 (Improper Certificate Validation) captures the root cause: the validation logic was structurally incomplete - it compared serial content without enforcing length equality, violating the requirement that two distinct serial numbers must match both in byte value AND in byte count. The one-line fix in PR #10554 inserts single->status->serialSz == id->status->serialSz && before the XMEMCMP call. The vulnerability is conditional on the HAVE_OCSP compile-time flag and OPENSSL_EXTRA compatibility layer being enabled, as confirmed by the test preprocessor guards.
RemediationAI
Apply the fix from wolfSSL PR #10554 (https://github.com/wolfSSL/wolfssl/pull/10554), which adds a serial-length equality check before the byte comparison in wolfSSL_OCSP_resp_find_status. A specific tagged release version incorporating this fix has not been independently confirmed - monitor https://www.wolfssl.com/docs/security-vulnerabilities/ for the official release announcement. As a compensating control for deployments where OCSP revocation checking is not strictly required, recompiling wolfSSL without HAVE_OCSP entirely removes the vulnerable code path, though this eliminates all OCSP-based revocation checking. Where OCSP must remain enabled, preferring OCSP stapling (server-provided responses over the TLS handshake) over client-initiated OCSP responder queries reduces the window for a rogue responder attack, as the server-stapled response is harder for a remote attacker to substitute. Note that disabling OCSP weakens revocation posture and should be weighed against the organization's certificate trust model.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today