Is CVE-2026-5188 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5188 being exploited in the wild.

How severe is CVE-2026-5188?

High severity, with a CVSS score of 8.1, published 10 April 2026.

Which products and versions are affected?

wolfSSL wolfSSL up to (excluding) 5.9.1.

Is there a fix for CVE-2026-5188?

A patch was published on 2026-03-20: Fix merged into master branch via pull request 10024 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5188 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5188?

Check whether you run Wolfssl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5188: wolfSSL integer underflow in X.509 SAN extension parsing

CVE-2026-5188 · Severity: high · CVSS 8.1 · Published 2026-04-10

wolfSSL is a security library used by applications to establish secure encrypted connections. A vulnerability in how it processes digital certificates could allow an attacker to provide a specially crafted certificate that causes the software to malfunction. This could lead to a service outage or potentially allow an attacker to access sensitive information, though it only affects systems using a specific, non-default configuration.

Technologies: Wolfssl. Vendors: Wolfssl.

Quick answers

Is CVE-2026-5188 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5188 being exploited in the wild.
How severe is CVE-2026-5188?: High severity, with a CVSS score of 8.1, published 10 April 2026.
Which products and versions are affected?: wolfSSL wolfSSL up to (excluding) 5.9.1.
Is there a fix for CVE-2026-5188?: A patch was published on 2026-03-20: Fix merged into master branch via pull request 10024 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5188 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5188?: Check whether you run Wolfssl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow exists in the `DecodeAltNames()` function within `wolfcrypt/src/asn.c`. When parsing the Subject Alternative Name (SAN) extension of an X.509 certificate, a malformed certificate can specify an entry length larger than the enclosing sequence. This causes the internal length counter to wrap (underflow) during the `length -= strLen` operation. The vulnerability is specifically located in the non-template ASN.1 parsing path, which is enabled via the `--enable-asn=original` flag and is off by default. An attacker can exploit this by presenting a malicious certificate during a TLS handshake or certificate validation process, potentially leading to a denial of service or information disclosure. The issue was addressed in version 5.9.1 by adding proper bounds checks before length subtraction.

Affected products

wolfSSL wolfSSL up to (excluding) 5.9.1

Timeline

2026-03-20: patched: Fix merged into master branch via pull request 10024
2026-04-10: disclosed: CVE-2026-5188 published

References

https://github.com/wolfSSL/wolfssl/pull/10024

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.