CVE-2026-93302
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
MatchTrustedPeer ignores the public key used, allowing forged CA clones to pass verification. Affected builds enable WOLFSSL_TRUST_PEER_CERT and load CA certificates via wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The peer must know the loaded certificates to exploit the issue.
Risk Assessment
A malicious (D)TLS server can bypass authentication by impersonating trusted CAs, potentially leading to interception or modification of communications, and in mutual authentication cases, attacks on the client.
Recommendation
Update wolfSSL to the latest version or apply the fix patch. Alternatively, use --disable-openssl-compatible-defaults and avoid loading CAs with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert().
Other vulnerabilities in wolfSSL
See all- CVE-2017-13099High
wolfSSL versions prior to 3.12.2 provide a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application.
- CVE-2017-8855High
wolfSSL versions before 3.11.0 do not prevent wc_DhAgree from accepting a malformed DH key.
- CVE-2017-8854High
wolfSSL versions before 3.10.2 have an out-of-bounds memory access issue when loading crafted DH parameters, leading to a buffer overflow triggered by a malformed temporary DH file.
- CVE-2015-6925High
wolfSSL versions (formerly CyaSSL) before 3.6.8 are vulnerable to a denial of service attack that can be triggered by a crafted DTLS cookie in a ClientHello message.
- CVE-2026-89134Critical
A certificate with no dNSName SAN but another SAN type present bypassed the Subject CN dNSName name-constraint check. This incomplete fix from CVE-2026-6731 was introduced in wolfSSL version 5.9.2.
- CVE-2023-3724Critical
CVE-2023-3724 affects TLS 1.3 clients that do not receive a PSK or KSE extension when connecting to a malicious server. In this case, a default predictable buffer is used for the IKM value, which may lead to session key compromise.
- CVE-2017-2800Critical
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution.
- CVE-2026-94417Medium
A vulnerability in wolfSSL causes CRL checking to be skipped for certificates without an OCSP URL when both OCSP and CRL revocation checking are enabled. As a result, a certificate revoked by CRL may be accepted, and a missing OCSP responder is treated as a positive response. The issue affects versions up to 5.9.2 and is reachable over TLS 1.0-1.3 and DTLS.
- CVE-2026-93304Low
A (D)TLS 1.2 client can accept a ChangeCipherSpec message before sending its ClientKeyExchange, allowing an attacker to complete the handshake in place of the server and send data the client accepts as authentic. DTLS 1.2 clients are exposed via datagram reads, and TLS 1.2 clients when using wolfSSL_inject() or read ahead.
- CVE-2026-89136High
When using RPK, the client side of TLS 1.2, 1.3 and DTLS 1.2 connections could accept an unsolicited server_cert_type=RawPublicKey, allowing a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in specific builds.
Original NVD description (English source)
MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and load CA certificates with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The peer must know the certificates being loaded to either of those APIs to take advantage of the issue. When OPENSSL_COMPATIBLE_DEFAULTS is also defined this widens the affected API to include all CA certificate loading. Both macros are defined when using autoconf builds such as (nginx, haproxy, stunnel, wpas, apache httpd, hitch, bind, rsyslog, ffmpeg, all, distro). When the certificate is listed as a trusted peer certificate the issue previously allowed for a malicious (D)TLS server to bypass authentication once knowing which CA’s the client would accept. This also affects mutual authentication cases where the client knows which CA’s the server has loaded. If building with any of these configurations and using (D)TLS where the loaded CA’s could be known and authentication of the peer is desired, users should either: update to the latest wolfSSL version, apply the fix patch, or use the configure flag --disable-openssl-compatible-defaults and not load CA’s with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert() to mitigate the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS