Vulnerability record · CVE-2026-55961 · published 25 June 2026

CVE-2026-55961: Wolfssl improper verification of cryptographic signature vulnerability

Wolfssl · Wolfssl

wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibility-layer verify path now rejects the object when no signer signature has actually been verified, so a PKCS#7 carrying no valid signature is no longer reported as verified. This is enforced regardless of the PKCS7_NOVERIFY flag, which only suppresses signer certificate chain validation and was never intended to waive the requirement that a signature exist. Only affects OpenSSL compatibility builds that call the PKCS7_verify() compatibility API on potentially degenerate PKCS#7 bundles.

8.2 CVSS 4.0 High EPSS 0.15% · top 96.8% CWE-347 · Improper verification of cryptographic signature

8.2CVSS 4.0 base score

0.15%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

26 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Wolfssl Wolfssl

References

Link	Tags
https://github.com/wolfSSL/wolfssl/pull/10702	Issue TrackingPatch
https://www.wolfssl.com/docs/security-vulnerabilities/	Vendor Advisory

Track CVE-2026-55961 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-5991Wolfssl out-of-bounds read vulnerabilityIn function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the fu…EPSS 0.56%27 Aug 2024 9.8CVE-2021-37155Wolfssl vulnerabilitywolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the serial number …EPSS 1.5%21 Jul 2021 9.8CVE-2020-36177Wolfssl out-of-bounds write vulnerabilityRsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size.EPSS 3.5%6 Jan 2021 9.8CVE-2014-2898Wolfssl out-of-bounds read vulnerabilitywolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers an out-o…EPSS 2.8%28 Jan 2020 9.8CVE-2014-2896Wolfssl out-of-bounds read vulnerabilityThe DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact an…EPSS 2.8%28 Jan 2020 9.8CVE-2014-2897Wolfssl out-of-bounds read vulnerabilityThe SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows remote atta…EPSS 2.8%28 Jan 2020 9.8CVE-2019-16748Wolfssl out-of-bounds read vulnerabilityIn wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there…EPSS 1.2%24 Sep 2019 9.8CVE-2019-15651Wolfssl out-of-bounds read vulnerabilitywolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is misha…EPSS 1.0%26 Aug 2019

Source: NIST National Vulnerability Database (record CVE-2026-55961), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.