CVE-Katalog

CVE-2026-55964

Chain intermediate CA:TRUE without keyCertSign…

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key Usage extension is present, but chain-supplied temporary CAs (WOLFSSL_TEMP_CA) added while building a certificate path were previously exempted from this check, so an intermediate asserting CA:TRUE but lacking keyCertSign was accepted as a signing CA. The check now applies to chain-supplied temporary CAs as well; only operator-loaded root certificates (WOLFSSL_USER_CA) and self-signed roots remain exempt. Per RFC 5280 an absent Key Usage extension implies all usages, so the requirement is enforced only when the extension is actually present (extKeyUsageSet). Affects the OpenSSL-compatibility certificate-path-building path (X509_verify_cert / X509_STORE, OPENSSL_EXTRA/OPENSSL_ALL), where untrusted chain intermediates are added as temporary CAs; native (non-OpenSSL-compat) certificate verification does not create temporary CAs and is unaffected. Within those builds, the check applies unless ALLOW_INVALID_CERTSIGN is defined.

Schweregrad: Medium · CVSS 6.3
Published: Jun 25, 2026, 8:17:16 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.19% · Oct 27, 2026

Projects and upstream resources

[wolfssl][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	wolfssl	`5.9.2-1`	FixedDistribution-reported fixed boundary	[CVE-2026-55964]
Debiansid	wolfssl	`5.9.2-1.2`	Fixed	[CVE-2026-55964]

Showing 2 fix observations. All 9 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	wolfssl	Not reported	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	wolfssl	`5.9.2`	UnknownSource applicability is not established	Provider not reported
Debianbookworm	wolfssl	Not reported	AffectedDistribution reports no fix	[CVE-2026-55964]
Debianbookworm	wolfssl	`5.5.4-2+deb12u2`	Affected	[CVE-2026-55964]
Debianbookworm-security	wolfssl	`5.5.4-2+deb12u3`	Affected	[CVE-2026-55964]
Debiansid	wolfssl	`5.9.2-1`	FixedDistribution-reported fixed boundary	[CVE-2026-55964]
Debiansid	wolfssl	`5.9.2-1.2`	Fixed	[CVE-2026-55964]
Debiantrixie	wolfssl	Not reported	AffectedDistribution reports no fix	[CVE-2026-55964]
Debiantrixie	wolfssl	`5.7.2-0.1+deb13u2`	Affected	[CVE-2026-55964]

Original provider fields

{
  "package_releases": [
    {
      "name": "wolfssl",
      "status": "fixed",
      "release": "sid",
      "version": "5.9.2-1.2"
    },
    {
      "name": "wolfssl",
      "status": "vulnerable",
      "release": "trixie",
      "version": "5.7.2-0.1+deb13u2"
    },
    {
      "name": "wolfssl",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "5.5.4-2+deb12u2"
    },
    {
      "name": "wolfssl",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "5.5.4-2+deb12u3"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1140815,
      "name": "wolfssl",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "5.9.2-1"
    },
    {
      "bug": 1140815,
      "name": "wolfssl",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1140815,
      "name": "wolfssl",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "end-of-life",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "wolfssl",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "wolfssl",
      "fixed_version": "5.9.2",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1140815]

Publisher notes

[trixie] wolfssl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libwolfssl35]Betroffen
Quellpaket: [wolfssl]
Details (4)
- 5.5.4-2+deb12u2 · amd64 · bookworm
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 12
- 5.5.4-2+deb12u2 · arm64 · bookworm
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 12
- 5.5.4-2+deb12u3 · amd64 · bookworm-security
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 12
- 5.5.4-2+deb12u3 · arm64 · bookworm-security
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 12
[libwolfssl-dev]Betroffen
Quellpaket: [wolfssl]
Details (4)
- 5.5.4-2+deb12u2 · amd64 · bookworm
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 12
- 5.5.4-2+deb12u2 · arm64 · bookworm
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 12
- 5.5.4-2+deb12u3 · amd64 · bookworm-security
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 12
- 5.5.4-2+deb12u3 · arm64 · bookworm-security
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 12

[Debian 13 (Trixie)]

[libwolfssl42t64]Betroffen
Quellpaket: [wolfssl]
Details (2)
- 5.7.2-0.1+deb13u1 · amd64 · trixie
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 13
- 5.7.2-0.1+deb13u1 · arm64 · trixie
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 13
[libwolfssl-dev]Betroffen
Quellpaket: [wolfssl]
Details (2)
- 5.7.2-0.1+deb13u1 · amd64 · trixie
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 13
- 5.7.2-0.1+deb13u1 · arm64 · trixie
  Betroffen
  nvd · wolfssl · debian · bookworm; pypi · wolfssl · debian · 13

Beobachtet: Oct 29, 2026, 10:17:05 AM UTC

Referenzen

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]