Skip to content
OpenAdvisories
High · 8.2 CVE-2026-55961 EUVD-2026-39491GHSA-cj56-5c53-9qjf

wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer

Published Jun 25, 2026 · Updated Jun 25, 2026 · Assigned by wolfSSL

Description

wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibility-layer verify path now rejects the object when no signer signature has actually been verified, so a PKCS#7 carrying no valid signature is no longer reported as verified. This is enforced regardless of the PKCS7_NOVERIFY flag, which only suppresses signer certificate chain validation and was never intended to waive the requirement that a signature exist. Only affects OpenSSL compatibility builds that call the PKCS7_verify() compatibility API on potentially degenerate PKCS#7 bundles.

Affected products

VendorProductAffectedFixed
wolfSSL wolfSSL 3.15.7 – ≤ 5.9.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 wolfssl 5.7.2-0.1+deb13u2 —
Debian 12 wolfssl 5.5.4-2+deb12u3 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 wolfssl No fix yet —
Ubuntu 26.04 LTS wolfssl No fix yet —
Ubuntu 25.10 wolfssl No fix yet —
Ubuntu 24.04 LTS wolfssl No fix yet —
Ubuntu 22.04 LTS wolfssl No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS wolfssl No fix yet —
Ubuntu 18.04 LTS wolfssl No fix yet —
Ubuntu 16.04 LTS wolfssl No fix yet —
ReleasePackageFixed inAdvisory
Alpine v3.24 wolfssl 5.9.2-r0 —

References