Is CVE-2026-10098 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10098 being exploited in the wild.

How severe is CVE-2026-10098?

Informational severity, with a CVSS score of 6.3, published 25 June 2026.

Is there a fix for CVE-2026-10098?

A patch was published on 2026-06-04: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10098 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10098?

Check whether you run Wolfssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10098: wolfSSL improper certificate validation in OCSP serial number lookup

CVE-2026-10098 · Severity: info · CVSS 6.3 · Published 2026-06-25

wolfSSL is a security library used to protect communications for embedded devices and cloud services. A flaw in how it checks certificate revocation status (OCSP) could allow a certificate to be incorrectly reported as valid if its serial number starts with the same digits as a revoked certificate from the same issuer. This could lead to a system trusting a revoked or fraudulent certificate, potentially compromising secure connections.

Technologies: Wolfssl. Vendors: Wolfssl.

Quick answers

Is CVE-2026-10098 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10098 being exploited in the wild.
How severe is CVE-2026-10098?: Informational severity, with a CVSS score of 6.3, published 25 June 2026.
Which products and versions are affected?: Wolfssl 4.6.0 through 5.9.1.
Is there a fix for CVE-2026-10098?: A patch was published on 2026-06-04: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10098 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10098?: Check whether you run Wolfssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A length-confusion vulnerability exists in the `wolfSSL_OCSP_resp_find_status` function. The lookup logic compares serial number bytes without first verifying that the lengths of the two serial numbers are equal. Consequently, if a `SingleResponse` exists for a certificate (from the same issuer) whose serial number is a prefix of the target certificate's serial, the function returns a match. This allows the revocation status of one certificate to be incorrectly applied to another. An attacker could potentially leverage this to bypass certificate revocation checks. The issue is resolved by requiring an exact length match before byte comparison.

Affected products

wolfSSL wolfSSL 4.6.0 through 5.9.1

Timeline

2026-05-29: other: Pull request submitted to wolfSSL repository
2026-06-04: patched: Fix merged into master branch
2026-06-25: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.