Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra whose application calls X509_verify_cert() with caller-supplied untrusted intermediates; for those users it is critical, otherwise the library is unaffected. Native wolfSSL TLS/DTLS usage is not impacted. X509_verify_cert() returned success based only on the last verified link rather than on reaching a trust anchor: when the supplied chain is deeper than the verifier's maximum path depth (default 100), path building runs out of depth while still walking untrusted intermediates and the chain is accepted even though it never reaches a configured trust anchor, allowing acceptance of an attacker-controlled certificate. The default TLS handshake (WOLFSSL_VERIFY_PEER) is not affected; only applications doing manual or deferred verification through this API are.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-25 | 1 | Disclosure1 |
| 2026-06-30 | 1 | Patch1 |
CVE-2026-11999 X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enabl… https://www.cve.org/CVERecord?id=CVE-2026-11999
Post summary
The text announces CVE-2026-11999 as a path‑depth exhaustion vulnerability in wolfSSL's X.509 verifier, providing technical details but no PoC, exploit, patch, or evidence of active exploitation.
Multiple wolfSSL vulnerabilities expose billions of servers and IoT devices to cyberattacks 🔹 Flaws in wolfSSL's certificate verifier (CVE-2026-11310, CVE-2026-11999) allow attacker-controlled certificates to be wrongly trusted 🔹 Crafted DTLS 1.3 ACK messages can trigger heap buffer overflows, risking remote crashes or code execution (CVE-2026-6679, CVE-2026-5264) 🔹 Admins urged to upgrade to wolfSSL 5.9.1 or 5.9.2 and disable unneeded features like OpenSSL compatibility and PKCS7 support
Post summary
Multiple wolfSSL CVEs let attackers bypass certificate verification and trigger heap overflows for code execution; a patch (wolfSSL 5.9.1/5.9.2) is available to mitigate the risks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wolfssl | wolfssl | - | - | - |