CVE-2026-5501

wolfSSL_X509_verify_cert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies an untrusted intermediate with Basic Constraints `CA:FALSE` that is legitimately signed by a trusted root. An attacker who obtains any leaf certificate from a trusted CA (e.g. a free DV cert from Let's Encrypt) can forge a certificate for any subject name with any public key and arbitrary signature bytes, and the function returns `WOLFSSL_SUCCESS` / `X509_V_OK`. The native wolfSSL TLS handshake path (`ProcessPeerCerts`) is not susceptible and the issue is limited to applications using the OpenSSL compatibility API directly, which would include integrations of wolfSSL into nginx and haproxy.

• CWE-295

• https://github.com/wolfSSL/wolfssl/pull/10102Issue Tracking

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55004Double free in Microsoft Printer Drivers allows an authorize…7.8
• CVE-2026-55005Heap-based buffer overflow in Microsoft Exchange Server allo…8.8
• CVE-2026-55006Insufficient granularity of access control in Microsoft Exch…7.8
• CVE-2026-55007Double free in Microsoft Exchange Server allows an unauthori…8.1
• CVE-2026-55008Improper neutralization of input during web page generation …9.6
• CVE-2026-55009Deserialization of untrusted data in Microsoft Exchange Serv…7.8
• CVE-2026-55010Heap-based buffer overflow in Minecraft Bedrock Dedicated Se…9.8
• CVE-2026-55011Integer underflow (wrap or wraparound) in Microsoft Defender…7.8
• CVE-2026-55012Integer overflow or wraparound in Microsoft Defender allows …7.8
• CVE-2026-55013Uncontrolled search path element in Windows Remote Help Defe…7.1
• CVE-2026-55014Improper access control in Windows Remote Help Defense allow…7.8
• CVE-2026-55015Uncontrolled search path element in Windows Remote Help allo…5.5