Loading story…
wolfSSL released version 5.9.4 addressing 11 vulnerabilities in its embedded TLS and cryptography library: three high-severity, four medium-severity, and four low-severity issues. The most serious defects affect particular optional features and non-default configurations, including trusted-peer certificates, RFC 6961 multiple OCSP stapling, and Raw Public Key support; affected deployments could permit certificate-validation bypasses or certificate forgery. Other fixes cover X.509 name-constraint validation, revoked-certificate handling, TLS/DTLS 1.2 ChangeCipherSpec processing, session-cache state, certificate-signature verification, and a TLS shutdown use-after-free condition.
The Canadian Centre for Cyber Security issued advisory AV26-969 for wolfSSL versions 5.9.4 and earlier and directed administrators to review the vendor release and apply available updates. Organizations using wolfSSL 5.9.2 or earlier should upgrade to 5.9.4 or an equivalent downstream package, assess enabled compile-time options and exposed APIs, and restart long-running affected applications where certificate or session state may remain in memory. The release also adds post-quantum cryptography capabilities, including native Falcon, FrodoKEM, and SLH-DSA support and AVX512 acceleration for ML-KEM and ML-DSA.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-969 concerning vulnerabilities affecting wolfSSL. It identified versions 5.9.4 and earlier as affected and advised users and administrators to review the release information and apply necessary updates when available.
wolfSSL released version 5.9.4, which addresses 11 vulnerabilities in its embedded TLS and cryptography library. The fixes include certificate-validation and authentication bypasses, OCSP/CRL validation issues, session-cache confusion, and a TLS shutdown use-after-free; many affect optional build configurations or specific APIs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly disclosed vulnerability, **CVE-2026-5194**, affects wolfSSL and can cause ECDSA certificate verification routines to accept digests smaller than required because hash/digest size and OID checks are missing. The flaw is classified as `CWE-295` and weakens certificate-based authentication by reducing the assurance that an ECDSA signature was validated against the proper digest constraints. The issue impacts ECDSA/ECC verification in wolfSSL configurations where **EdDSA** or **ML-DSA** is also enabled, and the risk is greater when the public CA key is known. Public references point to a wolfSSL GitHub pull request as well as MITRE and NVD tracking, while severity data published by Tenable includes CVSS v2, v3, and v4 scoring that describes a network-reachable issue with significant confidentiality and integrity impact in newer versions.
Jun 30, 2026
wolfSSL fixed two flaws in its hand-optimized ML-KEM-1024 SIMD decapsulation code that can permit near-complete private-key recovery when static ML-KEM keys are reused and an attacker can access a plaintext-checking or decapsulation oracle. **CVE-2026-10097** affects AVX2 builds by omitting comparison of the final 32 bytes of a 1,568-byte ciphertext, while **CVE-2026-6330** affects ARM64 NEON builds by leaving approximately half the ciphertext unchecked. Researchers reported recovery of 98.0% of secret coefficients with 400 chosen ciphertexts on AVX2 and 98.5% with 600 on NEON; wolfSSL addressed both issues in version 5.9.2. The defects are implementation failures in wolfSSL’s independently written SIMD Fujisaki–Okamoto ciphertext validation, not a break of ML-KEM or FIPS 203. They add to prior evidence that post-quantum cryptographic deployments remain exposed to implementation-level side channels: the KyberSlash research found secret-dependent timing behavior in several Kyber/ML-KEM implementations, including reference code, that enabled practical secret-key recovery on Raspberry Pi 2 and Arm Cortex-M4 systems. Organizations using wolfSSL should upgrade to 5.9.2 or later, identify long-lived static ML-KEM keys on affected AVX2 or NEON systems, and prioritize rotation of potentially exposed keys; TLS 1.3 deployments using freshly generated ephemeral hybrid ML-KEM keys are not susceptible to this key-recovery attack.
Sep 13, 2026
A public disclosure reported that **wolfSSL** versions `5.7.2` through `5.9.0-stable` contain a flaw in the **ML-DSA-44** signing path that frees a heap buffer holding private signing material without clearing it first. In native ML-DSA builds enabled with `--enable-mldsa` or `--enable-dilithium`, a same-process attacker can recover secret key material from reused heap memory and forge signatures on arbitrary messages. Researcher Abhinav Agarwal demonstrated end-to-end signature forgery on Linux and macOS, with forged signatures accepted by `wc_dilithium_verify_msg()` in compiled `libwolfssl` binaries. wolfSSL confirmed the issue and addressed it through fixes referenced in pull requests **#10100** and **#10113**, with the remediation shipping in **wolfSSL 5.9.1-stable**. The vendor did not assign a CVE and reportedly classified the finding as a bug rather than a vulnerability, even as its broader release advisory warned of multiple cryptographic verification weaknesses affecting certificate validation and signature handling. The disclosure also noted that similar missing-memory-clearing problems had previously been corrected in wolfSSL code paths for Dilithium key generation, Ed25519 signing, and Ed448 signing.
Jun 29, 2026