Multiple WolfSSL Critical Vulnerabilities: Certificate Bypass, RCE, and Post-Quantum Weakening — Threadlinqs Intelligence
As of 2026-06-30, Multiple WolfSSL Critical Vulnerabilities: Certificate Bypass, RCE, and Post-Quantum Weakening is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-1008 · Severity: CRITICAL · CVSS: 9.3 · Status: ACTIVE · Category: VULNERABILITY
WolfSSL cryptographic library versions before 5.9.1/5.9.2 contain eight critical vulnerabilities including X.509 certificate validation bypasses enabling MITM attacks, heap buffer overflows in DTLS
WolfSSL announced eight critical vulnerabilities on June 25-30, 2026, affecting versions 5.9.1 and earlier. The vulnerability set spans four distinct attack categories:
1. X.509 Certificate Trust-Chain Bypass (CVE-2026-11310, CVE-2026-11999, CVE-2026-6091, CVE-2026-55960): Four separate bypasses in certificate validation logic, specifically in OpenSSL compatibility code (OPENSSL_EXTRA builds). These vulnerabilities allow attackers to present invalid certificate chains that never reach a trust anchor but are accepted as valid, enabling man-in-the-middle attacks. Affects applications using X509_verify_cert() API with caller-supplied untrusted intermediates, S/MIME/CMS validation, code/firmware signing verification, and JWT/JWS x5c validation.
2. DTLS 1.3 Heap Buffer Overflows (CVE-2026-6679, CVE-2026-5264): Two separate heap buffer overflow vulnerabilities in DTLS 1.3 ACK serialization and processing paths. The first (CVE-2026-6679) results from integer truncation in computing ACK record-number list length, causing undersized buffer allocation. The second (CVE-2026-5264) occurs during crafted DTLS ACK message processing. Both occur before peer authentication and enable remote code execution with no user interaction required.
3. PKCS7 Stack Buffer Overflow (CVE-2026-5295): Unbounded OID copying in wc_PKCS7_DecryptOri() function processing CMS EnvelopedData with OtherRecipientInfo recipients. OID values longer than the fixed 32-byte MAX_OID_SZ buffer trigger stack overflow, affecting PKCS7-enabled builds with registered ORI decrypt callbacks.
4. ECDSA Signature Verification Weakness (CVE-2026-5194): Missing hash/digest size and OID validation in ECDSA certificate signature verification when EdDSA or ML-DSA (Dilithium) post-quantum algorithms are also enabled. Allows acceptance of undersized digests unsuitable for key type, weakening authentication in post-quantum cryptography deployments. Affects asn.c and ecc.c code paths.
The vulnerability set reveals systemic issues in cryptographic validation logic, boundary checking, and integration with post-quantum algorithms. Most vulnerabilities require minimal network interaction and no user intervention, making them highly exploitable. Certificate validation bypasses directly enable MITM attacks at scale. RCE vectors via DTLS allow direct system compromise. Post-quantum weakness undermines forward-secrecy deployments.
WolfSSL is embedded in billions of IoT devices (smartwatches, fitness trackers, medical devices), automotive systems (V2X communication), industrial control systems, embedded Linux devices, firmware update mechanisms, and server applications requiring lightweight TLS. Attackers exploiting these vulnerabilities can intercept encrypted communications, forge authentication credentials, execute arbitrary code on target devices, and bypass post-quantum cryptographic protections—directly impacting availability, confidentiality, and integrity of critical infrastructure.
Weaknesses (CWE)
CWE-295, CWE-190, CWE-197, CWE-787, CWE-122, CWE-121
Target sectors: consumer-devices, iot, automotive, health, industrial, telecoms, aerospace, government administration, finance
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-11310, CVE-2026-11999, CVE-2026-6091, CVE-2026-55960, CVE-2026-6679, CVE-2026-5264, CVE-2026-5295, CVE-2026-5194, T1190, T1195, T1059, T1106, T1547, T1068, T1600, T1553, T1685, T1528
