EUVD-2026-39578
GHSA-xpv9-p7vg-qhrc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High complexity because exploitation requires both MITM/rogue-responder position and a specifically crafted prefix-serial certificate; no confidentiality or availability impact applies.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared serial-number bytes without first requiring the two serial numbers to be of equal length, so a SingleResponse for one certificate (same issuer) whose serial is a prefix of the target's serial would match, returning the wrong certificate's status. The fix requires the serial lengths to be equal before comparing the serial bytes.
AnalysisAI
OCSP certificate status lookup in wolfSSL returns the wrong certificate's revocation status when a same-issuer SingleResponse serial number is a byte-prefix of the requested certificate's serial. The wolfSSL_OCSP_resp_find_status function in src/ocsp.c compared serial bytes via XMEMCMP without first verifying that both serial lengths are equal, allowing a 2-byte serial 01:02 in an OCSP response to satisfy a lookup for a 3-byte certificate serial 01:02:03. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) wolfSSL must be compiled with HAVE_OCSP and OPENSSL_EXTRA enabled - the vulnerability does not exist in builds without OCSP support; (2) the application must perform client-side OCSP certificate revocation checking during TLS certificate validation; and (3) the attacker must control or forge an OCSP response - either via MITM of unauthenticated HTTP OCSP traffic, DNS hijacking of the OCSP responder hostname, or operating as a rogue responder - and must craft a response containing a SingleResponse from the same CA issuer whose serial number bytes are a strict byte-prefix of the target certificate's serial. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.3 with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N reflects a network-reachable, unauthenticated flaw carrying limited integrity impact, but with Attack Requirements Present (AT:P) - meaning exploitation is not trivially passive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker performing a man-in-the-middle attack intercepts an application's OCSP request for a target certificate with serial `01:02:03` and substitutes a crafted OCSP response containing a SingleResponse for a same-CA certificate with serial `01:02` marked as CERT_GOOD. wolfSSL's prefix-matching bug causes the lookup to bind this shorter serial's GOOD status to the longer target serial, causing the application to treat the target certificate - potentially a revoked one - as valid. … |
| Remediation | Apply the fix from wolfSSL PR #10554 (https://github.com/wolfSSL/wolfssl/pull/10554), which adds a serial-length equality check before the byte comparison in `wolfSSL_OCSP_resp_find_status`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today