Loading vulnerability…
CVE-2026-94417 is an improper certificate revocation-validation vulnerability in wolfSSL versions 5.9.2 and earlier. In ProcessPeerCerts(), when OCSP and CRL checking are enabled on the same WOLFSSL_CTX or certificate manager, an OCSP soft-fail for a peer certificate lacking an Authority Information Access OCSP responder URL is treated as success before CRL fallback is evaluated. Consequently, wolfSSL can skip a loaded CRL check and accept a certificate that the CRL identifies as revoked. The flaw affects TLS 1.0 through TLS 1.3 and DTLS, including client verification of server certificates and server verification of client certificates in mutual or post-handshake authentication. It requires builds with both OCSP and CRL support and applications that enable both validation mechanisms on the same context or certificate manager. OCSP stapling used solely through wolfSSL_CTX_EnableOCSPStapling() is not affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Low-severity wolfSSL certificate-revocation validation bypass in OCSP and CRL fallback handling, which could accept a revoked certificate.
Low-severity wolfSSL OCSP/CRL fallback validation bypass that may permit acceptance of a revoked certificate.
A wolfSSL certificate-revocation validation flaw in versions 5.9.2 and earlier. When both OCSP and CRL checking are enabled, a peer certificate without an OCSP responder URL can bypass CRL revocation checking and be accepted even if listed as revoked. It affects TLS 1.0–1.3 and DTLS client/server certificate verification, including mutual authentication. An unchecked intermediate certificate may persist as a trusted signer within a long-running certificate manager context.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.