Skip to content
OpenAdvisories
Medium · 6.3 CVE-2026-10098 EUVD-2026-39578GHSA-xpv9-p7vg-qhrc

OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status

Published Jun 25, 2026 · Updated Jun 26, 2026 · Assigned by wolfSSL

Description

OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared serial-number bytes without first requiring the two serial numbers to be of equal length, so a SingleResponse for one certificate (same issuer) whose serial is a prefix of the target's serial would match, returning the wrong certificate's status. The fix requires the serial lengths to be equal before comparing the serial bytes.

Affected products

VendorProductAffectedFixed
wolfSSL wolfSSL 4.6.0 – ≤ 5.9.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 wolfssl No fix yet —
Debian 12 wolfssl No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 wolfssl No fix yet —
Ubuntu 26.04 LTS wolfssl No fix yet —
Ubuntu 25.10 wolfssl No fix yet —
Ubuntu 24.04 LTS wolfssl No fix yet —
Ubuntu 22.04 LTS wolfssl No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS wolfssl No fix yet —
Ubuntu 18.04 LTS wolfssl No fix yet —
Ubuntu 16.04 LTS wolfssl No fix yet —
ReleasePackageFixed inAdvisory
Alpine v3.24 wolfssl 5.9.2-r0 —

References