VulnSocial

CVE-2026-55961Disclosure(wolfssl / wolfssl)

LOWCVSS 7.5 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibility-layer verify path now rejects the object when no signer signature has actually been verified, so a PKCS#7 carrying no valid signature is no longer reported as verified. This is enforced regardless of the PKCS7_NOVERIFY flag, which only suppresses signer certificate chain validation and was never intended to waive the requirement that a signature exist. Only affects OpenSSL compatibility builds that call the PKCS7_verify() compatibility API on potentially degenerate PKCS#7 bundles.

wolfssl CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-347

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • wolfssl

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Affected systems

Vendors
wolfssl
Products
wolfssl

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-06-25: 3Technical Details · 2026-06-25: 306-25
Signal classification1 categories
Disclosure
3100.0%
Referenced assets4 URLs
Full discourse3 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-55961 Improper PKCS#7 Signature Verification in wolfSSL Compati... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-55961 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2

    Post summary

    A brief disclosure of CVE-2026-55961, noting an improper PKCS#7 signature verification issue in wolfSSL, without any PoC, exploit, or mitigation details.

    00000107
    4.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-55961 wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the underlying … https://www.cve.org/CVERecord?id=CVE-2026-55961 ----- Traducción: CVE-2026-55961 wol… http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-55961, detailing wolfSSL’s verify function incorrectly accepting PKCS#7 objects without signers, without providing exploit code, patch information, or evidence of active exploitation.

    0000047
    89 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-55961 wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the underlying … https://www.cve.org/CVERecord?id=CVE-2026-55961

    Post summary

    The excerpt details a flaw in wolfSSL’s PKCS7 verification where a certs‑only PKCS#7 object mistakenly succeeds, identifying CVE‑2026‑55961.

    00000725
    57.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appwolfsslwolfssl---

Explore more

Back to dashboardwolfssl CVEswolfssl vulnerabilities