TLDR Tech / InfoSec
Critical flaw in wolfSSL library enables forged certificate use
A critical vulnerability (CVE-2026-5194) in the wolfSSL library allows attackers to use forged certificates with undersized digests. This flaw bypasses ECDSA, DSA, ML-DSA, Ed25519, and Ed448 signature verification because of missing hash/digest size and OID checks, impacting over 5 billion devices and applications. The vulnerability was patched in wolfSSL 5.9.1 on April 8. Users of vendor firmware or distro-packaged builds should wait for downstream advisories instead of assuming immediate protection from the upstream fix.
Read the full story