# wolfSSL vulnerabilities

Source: https://junglewise.ai/threats/technologies/wolfssl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/wolfssl.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 64 vulnerabilities in wolfSSL: 0 in the last 7 days and 12 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-95208, was published on 8 October 2026. Nothing in the last four weeks, down from 12 vulnerabilities in the four before.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 12
- All time: 64 (2 critical, 0 exploited in the wild)

## About wolfSSL

Lightweight cryptographic library providing SSL/TLS protocol support and cryptographic functions.

## Latest wolfSSL vulnerabilities

- [CVE-2026-95208: wolfSSL certificate validation bypass in ConfirmNameConstraints()](https://junglewise.ai/threats/cve-2026-95208-an-issue-in-the-confirmnameconstraints-function-wolfcrypt-src-asn) (high, CVSS 7.5, published 8 Oct 2026)
- [CVE-2026-94417: wolfSSL revocation check bypass with OCSP and CRL](https://junglewise.ai/threats/cve-2026-94417-when-an-application-enables-both-ocsp-and-crl-revocation-checking) (info, published 27 Sep 2026)
- [CVE-2026-93304: wolfSSL TLS 1.2 ChangeCipherSpec message ordering bypass](https://junglewise.ai/threats/cve-2026-93304-a-d-tls-1-2-client-can-accept-a-changecipherspec-message-before) (info, published 27 Sep 2026)
- [CVE-2026-93302: wolfSSL MatchTrustedPeer public key validation bypass](https://junglewise.ai/threats/cve-2026-93302-matchtrustedpeer-ignores-the-public-key-used-leading-to-forged-ca) (info, published 27 Sep 2026)
- [CVE-2026-89136: wolfSSL TLS authentication bypass in Raw Public Key handling](https://junglewise.ai/threats/cve-2026-89136-when-using-rpk-raw-public-key-the-client-side-of-a-tls-1-2-1-3) (info, published 27 Sep 2026)
- [CVE-2026-89135: wolfSSL X509_verify_cert certificate validation bypass in CertManager](https://junglewise.ai/threats/cve-2026-89135-a-failed-x509-verify-cert-call-permanently-plants-an-unverified) (info, published 27 Sep 2026)
- [CVE-2026-89134: wolfSSL certificate name-constraint bypass via SAN mismatch](https://junglewise.ai/threats/cve-2026-89134-a-certificate-with-no-dnsname-san-but-another-san-type-present-e) (info, published 27 Sep 2026)
- [CVE-2026-89133: wolfSSL X.509 certificate validation bypass in NameConstraints](https://junglewise.ai/threats/cve-2026-89133-wolfssl-versions-5-9-2-and-earlier-contain-a-flaw-in-the-x-509) (info, published 27 Sep 2026)
- [CVE-2026-89102: wolfSSL certificate forgery in OCSP response stapling](https://junglewise.ai/threats/cve-2026-89102-in-wolfssl-versions-5-7-2-through-5-9-2-there-is-a-client-side) (info, published 27 Sep 2026)
- [CVE-2026-15442: wolfSSL heap-use-after-free in TLS shutdown](https://junglewise.ai/threats/cve-2026-15442-in-all-builds-that-make-use-of-d-tls-including-default-builds) (info, published 27 Sep 2026)
- [CVE-2026-94419: wolfSSL session cache poisoning in TLS 1.2 resumption](https://junglewise.ai/threats/cve-2026-94419-without-no-session-cache-ref-wolfssl-get-session-does-not-return) (info, published 27 Sep 2026)
- [CVE-2026-94418: WolfSSL certificate signature verification bypass under WOLFSSL_SMALL_CERT_VERIFY](https://junglewise.ai/threats/cve-2026-94418-under-wolfssl-small-cert-verify-processpeercertparse-runs-the) (info, published 27 Sep 2026)
- [CVE-2026-8720: wolfSSL HMAC-BLAKE2 message integrity bypass via oversized keys](https://junglewise.ai/threats/cve-2026-8720-wolfssl-hmac-blake2-message-integrity-bypass-via-oversized-keys) (info, CVSS 5.9, published 25 Jun 2026)
- [CVE-2026-7532: wolfSSL IP address name constraints bypass when WOLFSSL_IP_ALT_NAME is undefined](https://junglewise.ai/threats/cve-2026-7532-wolfssl-ip-address-name-constraints-bypass-when-wolfssl-ip-alt) (info, CVSS 5.7, published 25 Jun 2026)
- [CVE-2026-7511: wolfSSL improper signature verification in PKCS7_verify](https://junglewise.ai/threats/cve-2026-7511-wolfssl-improper-signature-verification-in-pkcs7-verify) (info, CVSS 5.9, published 25 Jun 2026)
- [CVE-2026-6331: wolfSSL HMAC zero-length tag forgery in EVP_DigestVerifyFinal](https://junglewise.ai/threats/cve-2026-6331-wolfssl-hmac-zero-length-tag-forgery-in-evp-digestverifyfinal) (info, CVSS 2.1, published 25 Jun 2026)
- [CVE-2026-6330: wolfSSL ML-KEM partial ciphertext comparison on ARM64 NEON](https://junglewise.ai/threats/cve-2026-6330-wolfssl-ml-kem-partial-ciphertext-comparison-on-arm64-neon) (info, CVSS 6.3, published 25 Jun 2026)
- [CVE-2026-6329: wolfSSL improper MAC verification in PKCS#12](https://junglewise.ai/threats/cve-2026-6329-wolfssl-improper-mac-verification-in-pkcs-12) (info, CVSS 6, published 25 Jun 2026)
- [CVE-2026-6325: wolfSSL out-of-bounds write in SetSuitesHashSigAlgo](https://junglewise.ai/threats/cve-2026-6325-wolfssl-out-of-bounds-write-in-setsuiteshashsigalgo) (info, CVSS 2, published 25 Jun 2026)
- [CVE-2026-6092: wolfSSL algorithm downgrade from Encrypt-then-MAC to MAC-then-Encrypt](https://junglewise.ai/threats/cve-2026-6092-wolfssl-algorithm-downgrade-from-encrypt-then-mac-to-mac-then) (info, CVSS 2.1, published 25 Jun 2026)
- [CVE-2026-55962: wolfSSL improper authentication in TLS 1.3 post-handshake authentication](https://junglewise.ai/threats/cve-2026-55962-wolfssl-improper-authentication-in-tls-1-3-post-handshake) (info, CVSS 6, published 25 Jun 2026)
- [CVE-2026-11703: wolfSSL improper authentication in session-ID resumption](https://junglewise.ai/threats/cve-2026-11703-wolfssl-improper-authentication-in-session-id-resumption) (info, CVSS 6, published 25 Jun 2026)
- [CVE-2026-10098: wolfSSL improper certificate validation in OCSP serial number lookup](https://junglewise.ai/threats/cve-2026-10098-wolfssl-improper-certificate-validation-in-ocsp-serial-number) (info, CVSS 6.3, published 25 Jun 2026)
- [CVE-2026-6731: wolfSSL X.509 name constraint bypass in Subject Common Name](https://junglewise.ai/threats/cve-2026-6731-wolfssl-x-509-name-constraint-bypass-in-subject-common-name) (info, CVSS 6, published 25 Jun 2026)
- [CVE-2026-6681: wolfSSL out-of-bounds write in PKCS#7 decoding](https://junglewise.ai/threats/cve-2026-6681-wolfssl-out-of-bounds-write-in-pkcs-7-decoding) (info, CVSS 1, published 25 Jun 2026)

## Most severe wolfSSL vulnerabilities

- [CVE-2026-5194: wolfSSL improper certificate validation in ECDSA signature verification](https://junglewise.ai/threats/cve-2026-5194-wolfssl-improper-certificate-validation-in-ecdsa-signature) (critical, CVSS 9.1, published 9 Apr 2026)
- [CVE-2026-5393: wolfSSL out-of-bounds read in dual-algorithm CertificateVerify processing](https://junglewise.ai/threats/cve-2026-5393-wolfssl-out-of-bounds-read-in-dual-algorithm-certificateverify) (critical, CVSS 9.1, published 10 Apr 2026)
- [CVE-2025-11931: Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a…](https://junglewise.ai/threats/cve-2025-11931-integer-underflow-leads-to-out-of-bounds-access-in-xchacha20) (high, CVSS 8.2, published 21 Nov 2025)
- [CVE-2026-5501: wolfSSL improper certificate validation in OpenSSL compatibility layer](https://junglewise.ai/threats/cve-2026-5501-wolfssl-improper-certificate-validation-in-openssl-compatibility) (high, CVSS 8.1, published 10 Apr 2026)
- [CVE-2026-5479: wolfSSL improper authentication tag validation in ChaCha20-Poly1305 decryption](https://junglewise.ai/threats/cve-2026-5479-wolfssl-improper-authentication-tag-validation-in-chacha20) (high, CVSS 8.1, published 10 Apr 2026)
- [CVE-2026-5466: wolfSSL improper signature verification in ECCSI wc_VerifyEccsiHash](https://junglewise.ai/threats/cve-2026-5466-wolfssl-improper-signature-verification-in-eccsi-wc) (high, CVSS 8.1, published 10 Apr 2026)
- [CVE-2026-5188: wolfSSL integer underflow in X.509 SAN extension parsing](https://junglewise.ai/threats/cve-2026-5188-wolfssl-integer-underflow-in-x-509-san-extension-parsing) (high, CVSS 8.1, published 10 Apr 2026)
- [CVE-2025-12888: Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler…](https://junglewise.ai/threats/cve-2025-12888-vulnerability-in-x25519-constant-time-cryptographic) (high, CVSS 7.5, published 21 Nov 2025)
- [CVE-2025-11935: With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward…](https://junglewise.ai/threats/cve-2025-11935-with-tls-1-3-pre-shared-key-psk-a-malicious-or-faulty-server) (high, CVSS 7.5, published 21 Nov 2025)
- [CVE-2026-95208: wolfSSL certificate validation bypass in ConfirmNameConstraints()](https://junglewise.ai/threats/cve-2026-95208-an-issue-in-the-confirmnameconstraints-function-wolfcrypt-src-asn) (high, CVSS 7.5, published 8 Oct 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 12 vulnerabilities in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 11 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 1 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other Wolfssl technologies

- [Wolfssl wolfSSH](https://junglewise.ai/threats/technologies/wolfssl-wolfssh): 5 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "wolfSSL vulnerabilities", https://junglewise.ai/threats/technologies/wolfssl, 9 November 2026.