wolfSSL (Product): news timeline & CVEs

wolfSSL 5.9.4 Patches 11 Security Flaws Affecting TLS and Certificate Validation

wolfSSL 5.9.4 fixes 11 TLS and certificate-validation flaws, including trusted-peer and OCSP authentication bypasses.

wolfSSL 5.9.4 fixes 11 flaws in TLS and DTLS handshakes, X.509 validation, OCSP stapling, session resumption, and memory safety. CVE-2026-93302, affecting 5.3.0 through 5.9.2, can let a forged CA clone pass trusted-peer checks when WOLFSSL_TRUST_PEER_CERT is enabled. High-severity CVE-2026-89102 and CVE-2026-89136 may bypass authentication in multi-OCSP and Raw Public Key builds. Other fixes include ChangeCipherSpec ordering, NameConstraints bypasses, skipped CRL checks, session-cache poisoning, and a heap use-after-free. No exploitation is reported.

GBHackersSep 29, 10:18 UTC · 11d agoVulnerability CVE-2026-93302 CVE-2026-89102 CVE-2026-89136+7 CVEs2· 1 read

wolfSSL security advisory (AV26-969)

Canada's Cyber Centre warns wolfSSL 5.9.4 and earlier are affected and urges administrators to update.

The Canadian Centre for Cyber Security issued advisory AV26-969 on September 28, 2026, stating wolfSSL versions up to and including 5.9.4 are affected by vulnerabilities. The bulletin points to a September 25, 2026 wolfSSL release but does not list CVE identifiers or describe the flaws. It urges users and administrators to review the vendor release and apply necessary updates.

Canadian Centre for Cyber SecuritySep 28, 18:35 UTC · 12d agoAdvisory1· 1 read

wolfSSL

Timeline2 articles

Related CVEsby mentions

Appears with

wolfSSL 5.9.4 Patches 11 Security Flaws Affecting TLS and Certificate Validation

wolfSSL security advisory (AV26-969)