CVE catalog

CVE-2026-5188

An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can specify an entry length larger than the enclos

[CVE catalog]

Severity
Low · CVSS 2.3
Published
Source
[NVD] · [CVE record]
EPSS
0.14% · Oct 25, 2026

An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can specify an entry length larger than the enclosing sequence, causing the internal length counter to wrap during parsing. This results in incorrect handling of certificate data. The issue is limited to configurations using the original ASN.1 parsing implementation which is off by default.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianwolfsslsid5.9.2-1.2fixed
Debianwolfssltrixie5.7.2-0.1+deb13u2vulnerable
Debianwolfsslbookworm5.5.4-2+deb12u2vulnerable
Debianwolfsslbookworm-security5.5.4-2+deb12u3vulnerable
CpewolfsslNot reportedNot reportedvulnerable
CpewolfsslNot reported5.9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianwolfsslsourcesid5.9.1-0.1not yet assignedNot reported[1133835]
Debianwolfsslsourcetrixie(unfixed)not yet assignedNot reported[1133835]
Debianwolfsslsourcebookworm(unfixed)not yet assignedNot reported[1133835]
CpewolfsslcpeNot reported5.9.1Not reportedNot reportedNot reported

[Debian bug #1133835]

Notes

[trixie] wolfssl: Minor issue [bookworm] wolfssl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libwolfssl35]Affected

    Source package: [wolfssl]

    Details (4)

    • 5.5.4-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · wolfssl · debian · bookworm; nvd · wolfssl · debian · 12

    • 5.5.4-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · wolfssl · debian · bookworm; nvd · wolfssl · debian · 12

    • 5.5.4-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · wolfssl · debian · bookworm; nvd · wolfssl · debian · 12

    • 5.5.4-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · wolfssl · debian · bookworm; nvd · wolfssl · debian · 12

  • [libwolfssl-dev]Affected

    Source package: [wolfssl]

    Details (4)

    • 5.5.4-2+deb12u2 · amd64 · bookworm

      Affected

      nvd · wolfssl · debian · bookworm; nvd · wolfssl · debian · 12

    • 5.5.4-2+deb12u2 · arm64 · bookworm

      Affected

      nvd · wolfssl · debian · bookworm; nvd · wolfssl · debian · 12

    • 5.5.4-2+deb12u3 · amd64 · bookworm-security

      Affected

      nvd · wolfssl · debian · bookworm; nvd · wolfssl · debian · 12

    • 5.5.4-2+deb12u3 · arm64 · bookworm-security

      Affected

      nvd · wolfssl · debian · bookworm; nvd · wolfssl · debian · 12

[Debian 13 (Trixie)]

  • [libwolfssl42t64]Affected

    Source package: [wolfssl]

    Details (2)

    • 5.7.2-0.1+deb13u1 · amd64 · trixie

      Affected

      nvd · wolfssl · debian · 13

    • 5.7.2-0.1+deb13u1 · arm64 · trixie

      Affected

      nvd · wolfssl · debian · 13

  • [libwolfssl-dev]Affected

    Source package: [wolfssl]

    Details (2)

    • 5.7.2-0.1+deb13u1 · amd64 · trixie

      Affected

      nvd · wolfssl · debian · 13

    • 5.7.2-0.1+deb13u1 · arm64 · trixie

      Affected

      nvd · wolfssl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]