Executive brief
wolfSSL is a lightweight security library used to establish secure connections for embedded devices and cloud applications. A flaw in how the library processes Certificate Revocation Lists (CRLs) could allow a specially crafted list to be accepted even if it contains instructions that the library does not recognize. This could lead to the improper validation of digital certificates, though the risk is limited as the attacker would need significant access to the network infrastructure.
Technical details
A vulnerability exists in the `ParseCRL_Extensions` function within wolfSSL where critical extensions are not properly enforced. According to RFC 5280, a system must reject a CRL if it encounters a critical extension it does not recognize; however, wolfSSL may accept a crafted CRL containing such extensions. This issue specifically affects builds where CRL support is enabled and requires the crafted CRL to have a trusted signature. An attacker with the ability to provide a signed CRL could bypass intended security constraints defined in unhandled critical extensions. The issue was addressed in wolfSSL version 5.9.1.
Affected products
- wolfSSL wolfSSL 4.3.0 through 5.9.0
Timeline
- 2026-04-21: patched: Pull request merged into master branch
- 2026-06-25: disclosed: CVE published to NVD