CVE-2026-55960
Last modified
CVE-2026-55960 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative() accepts it without performing any trust verification; it must therefore only be accepted when RPK was actually negotiated for that peer. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative() accepts it without performing any trust verification; it must therefore only be accepted when RPK was actually negotiated for that peer. The check now defaults the expected type to X.509 (per RFC 7250/8446) when no type was negotiated, comparing against the received server certificate type on the client and the selected client certificate type on the server, and rejects any mismatch, including an un-negotiated raw public key, with UNSUPPORTED_CERTIFICATE. Only affects builds with Raw Public Key support (HAVE_RPK) enabled - disabled by default in a standalone build, but included in --enable-all.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wolfssl | Wolfssl | >= 5.6.4, < 5.9.2 |
References
- https://github.com/wolfSSL/wolfssl/pull/10702Issue Tracking, Patch
- https://www.wolfssl.com/docs/security-vulnerabilities/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-55960?
How severe is CVE-2026-55960?
How do I fix CVE-2026-55960?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-55954Authentication Bypass by Spoofing vulnerability in ueberauth…9.1
- CVE-2026-55955Improper Authentication vulnerability in Apache Tomcat allow…6.5
- CVE-2026-55956Improper Authorization vulnerability in Apache Tomcat leads …6.5
- CVE-2026-55957Missing Critical Step in Authentication vulnerability in Apa…7.3
- CVE-2026-55958Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript b…7.5
- CVE-2026-5596A vulnerability was detected in griptape-ai griptape 0.19.4.…6.3
- CVE-2026-55961wolfSSL_PKCS7_verify() returning success for a degenerate (c…7.5
- CVE-2026-55962TLS 1.3 post-handshake authentication (PHA) issue where a se…6.5
- CVE-2026-55964Chain intermediate CA:TRUE without keyCertSign accepted as a…5.3
- CVE-2026-55967AES-GCM encryption/decryption with extremely large cumulativ…7.5
- CVE-2026-55968Inefficient Algorithmic Complexity, Allocation of Resources …7.5
- CVE-2026-55969Integer Overflow or Wraparound vulnerability in Apache Thrif…7.5
Are you affected by CVE-2026-55960?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST