# CVE-2026-5393: wolfSSL out-of-bounds read in dual-algorithm CertificateVerify processing

Source: https://junglewise.ai/threats/cve-2026-5393-wolfssl-out-of-bounds-read-in-dual-algorithm-certificateverify  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-5393 · Severity: critical · CVSS 9.1 · Published 2026-04-10

wolfSSL is a lightweight security library used to provide encrypted communications for applications and embedded devices. A vulnerability in how the library handles specific types of digital certificates could allow an attacker to crash a service or potentially access sensitive information from the system's memory. This issue only affects systems where specific experimental features were manually enabled during the software's build process.

Technologies: [Wolfssl](https://junglewise.ai/threats/technologies/wolfssl). Vendors: [Wolfssl](https://junglewise.ai/threats/vendors/wolfssl).

## Quick answers

**Is CVE-2026-5393 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5393 being exploited in the wild.

**How severe is CVE-2026-5393?** Critical severity, with a CVSS score of 9.1, published 10 April 2026.

**Which products and versions are affected?** wolfSSL wolfSSL versions up to (excluding) 5.9.1.

**Is there a fix for CVE-2026-5393?** A patch was published on 2026-03-30: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5393 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5393?** Check whether you run Wolfssl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in wolfSSL's handling of dual-algorithm CertificateVerify messages. The flaw is triggered during the parsing of crafted input when the library is compiled with experimental dual-algorithm certificate support (--enable-experimental and --enable-dual-alg-certs). An unauthenticated remote attacker can exploit this by sending a specially crafted handshake message, leading to a crash (DoS) or the leakage of sensitive memory contents. The issue was addressed in version 5.9.1 by adding proper bounds checking when parsing dual-algorithm certificate signatures.

## Affected products

- wolfSSL wolfSSL versions up to (excluding) 5.9.1

## Timeline

- 2026-03-26: other: Fix submitted via pull request
- 2026-03-30: patched: Fix merged into master branch
- 2026-04-09: disclosed: Initial CVE disclosure by wolfSSL
- 2026-04-10: advisory: NVD publication date

## References

- [https://github.com/wolfSSL/wolfssl/pull/10079](https://github.com/wolfSSL/wolfssl/pull/10079)

## Related threats

- [wolfSSL certificate validation bypass in ConfirmNameConstraints()](https://junglewise.ai/threats/cve-2026-95208-an-issue-in-the-confirmnameconstraints-function-wolfcrypt-src-asn)
- [wolfSSL revocation check bypass with OCSP and CRL](https://junglewise.ai/threats/cve-2026-94417-when-an-application-enables-both-ocsp-and-crl-revocation-checking)
- [wolfSSL TLS 1.2 ChangeCipherSpec message ordering bypass](https://junglewise.ai/threats/cve-2026-93304-a-d-tls-1-2-client-can-accept-a-changecipherspec-message-before)
- [wolfSSL MatchTrustedPeer public key validation bypass](https://junglewise.ai/threats/cve-2026-93302-matchtrustedpeer-ignores-the-public-key-used-leading-to-forged-ca)
- [wolfSSL TLS authentication bypass in Raw Public Key handling](https://junglewise.ai/threats/cve-2026-89136-when-using-rpk-raw-public-key-the-client-side-of-a-tls-1-2-1-3)