# CVE-2026-94417: wolfSSL revocation check bypass with OCSP and CRL

Source: https://junglewise.ai/threats/cve-2026-94417-when-an-application-enables-both-ocsp-and-crl-revocation-checking  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-94417 · Severity: info · Published 2026-09-27

wolfSSL, a cryptographic library used by many network applications, has a flaw in how it validates SSL/TLS certificates when both OCSP and CRL revocation checking are enabled. An attacker could present a certificate that should have been rejected as revoked, causing the application to accept it as valid. This affects long-running processes and could allow unauthorized access or man-in-the-middle attacks.

Technologies: [Wolfssl](https://junglewise.ai/threats/technologies/wolfssl). Vendors: [Wolfssl](https://junglewise.ai/threats/vendors/wolfssl).

## Quick answers

**Is CVE-2026-94417 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94417 being exploited in the wild.

**How severe is CVE-2026-94417?** Informational severity, published 27 September 2026.

**Which products and versions are affected?** Wolfssl 5.9.2 and earlier.

**Is there a fix for CVE-2026-94417?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-94417 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-94417?** Check whether you run Wolfssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

When OCSP and CRL revocation checks are both enabled on a WOLFSSL_CTX or certificate manager, the library incorrectly treats a missing OCSP responder as a successful OCSP result, skipping the CRL fallback check. This allows revoked certificates to be accepted if they lack an Authority Information Access OCSP URL. The vulnerability exists in ProcessPeerCerts() and is reachable over all supported TLS versions (1.0–1.3) and DTLS for both client and server certificate verification.

## Affected products

- wolfSSL wolfSSL 5.9.2 and earlier

## Timeline

- 2026-09-27: disclosed

## Related threats

- [wolfSSL certificate validation bypass in ConfirmNameConstraints()](https://junglewise.ai/threats/cve-2026-95208-an-issue-in-the-confirmnameconstraints-function-wolfcrypt-src-asn)
- [wolfSSL TLS 1.2 ChangeCipherSpec message ordering bypass](https://junglewise.ai/threats/cve-2026-93304-a-d-tls-1-2-client-can-accept-a-changecipherspec-message-before)
- [wolfSSL MatchTrustedPeer public key validation bypass](https://junglewise.ai/threats/cve-2026-93302-matchtrustedpeer-ignores-the-public-key-used-leading-to-forged-ca)
- [wolfSSL TLS authentication bypass in Raw Public Key handling](https://junglewise.ai/threats/cve-2026-89136-when-using-rpk-raw-public-key-the-client-side-of-a-tls-1-2-1-3)
- [wolfSSL X509_verify_cert certificate validation bypass in CertManager](https://junglewise.ai/threats/cve-2026-89135-a-failed-x509-verify-cert-call-permanently-plants-an-unverified)