Bleepingcomputer Critical Vulnerability in wolfSSL Affects 5 Billion Devices
Article Content
- •CVE-2026-5194 allows forgery of digital signatures in wolfSSL, affecting 5 billion devices.
- •The vulnerability stems from inadequate checks on hash/digest sizes and OIDs during verification.
- •An emergency patch (version 5.9.1) was released on April 8, 2026, but many devices may remain unpatched.
A critical vulnerability (CVE-2026-5194) in the wolfSSL library, which handles TLS encryption for over 5 billion devices, allows attackers to forge digital signatures, potentially compromising certificate-based authentication. The flaw arises from missing checks for hash/digest sizes and Object Identifiers (OIDs), enabling the acceptance of weak digests during signature verification. This vulnerability impacts multiple signature algorithms, including ECDSA, DSA, and EdDSA. An emergency patch was released in wolfSSL version 5.9.1 on April 8, 2026, to address this issue. Security experts warn that outdated devices may remain vulnerable as many manufacturers may not issue updates. The flaw has been rated as critical, with a severity score of 9.3 to 10.0, indicating a high risk of exploitation. Organizations using wolfSSL are urged to apply the patch immediately to mitigate risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (8)
Following this threat?
Track Red Hat and CVE-2026-5194 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…