CVE-2026-10098: wolfSSL OCSP Serial-Number Prefix-Match Certificate Validation Bypass

Technical summary

The vulnerability resides in wolfSSL's OCSP_resp_find_status function, which performs certificate revocation status lookups by matching the CertID fields in OCSP SingleResponse structures against a target certificate. The flaw is a classic prefix-matching bug: the function compares serial-number bytes without enforcing length equality beforehand. When a SingleResponse's serial is a strict prefix of the target certificate's serial (e.g., target serial 0x0102030405, response serial 0x01020304), the byte comparison returns a match, causing the function to return the wrong certificate's revocation status. The fix enforces that both serial numbers must be identical in length before performing the byte comparison. This is a certificate validation bypass affecting the CertID matching logic (CWE-295: Improper Certificate Validation).

Business impact

Incorrect OCSP revocation status reporting can undermine trust in certificate validation, a foundational security control. Organizations relying on wolfSSL for TLS/SSL operations may unknowingly accept connections from certificates that should be revoked, or reject valid ones. The impact is most severe in environments where OCSP is the primary or sole revocation-checking mechanism. Affected deployments could suffer from compromised confidentiality of communications if a revoked certificate (potentially belonging to a malicious endpoint) is incorrectly validated as current.

Affected systems

wolfSSL versions prior to the fix are affected. The vulnerability applies to any application using wolfSSL's OCSP functionality, particularly those that validate certificates against an external OCSP responder. Embedded systems, IoT devices, and server applications using wolfSSL for certificate management are potential targets. Verify the exact patched version against the wolfSSL vendor advisory.

Exploitability

Exploitability is moderate. The attack requires either control of an OCSP responder or the ability to perform a man-in-the-middle attack on OCSP traffic to inject a crafted response with a serial number that is a prefix of the target. The attack does not require user interaction or elevated privileges, and the network is accessible from the internet if OCSP queries are made over public networks. However, the attacker must have prior knowledge of certificate serial numbers and access to a suitable OCSP endpoint or network path.

Remediation

Update wolfSSL to a version that includes the serial-length equality check in the OCSP CertID matching logic. Check the wolfSSL security advisory for the specific patched version. No workarounds are known; patching is the primary remediation. Organizations should also review their certificate validation policies to ensure OCSP is not the sole revocation mechanism, and consider enabling CRL (Certificate Revocation List) as a secondary check.

Patch guidance

Consult the wolfSSL project repository or official security advisory for the patched version number and release date. Apply patches promptly to all systems running wolfSSL, including embedded devices and production servers. Test thoroughly in a staging environment before production deployment, as OCSP changes can affect certificate validation timing and behavior. Verify that post-patch OCSP lookups correctly reject prefix-match certificates.

Detection guidance

Monitor OCSP response logs for unusual patterns, such as SingleResponse entries with serial numbers that are prefixes of your organization's certificate serials. Implement OCSP stapling to reduce reliance on real-time responder queries and gain better control over response validation. Use certificate pinning in critical applications to further reduce the risk of accepting incorrect revocation status. Audit wolfSSL version usage across your infrastructure and prioritize patch deployment based on exposure to untrusted OCSP responders.

Why prioritize this

Although scored MEDIUM (5.3), this vulnerability should be prioritized for prompt patching because it directly undermines a core security control—certificate revocation checking. The attack surface is network-accessible with no authentication required. Organizations that rely on OCSP for compliance or security policy should treat this as a near-term patch obligation. The simplicity of the fix and the fundamental nature of the flaw make rapid deployment feasible.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible, low-complexity attack that requires no privileges or user interaction but results only in integrity impact (wrong revocation status reported). The attack does not directly cause confidentiality loss or availability impact; however, the integrity compromise can lead to downstream trust failures. The MEDIUM rating appropriately captures the seriousness of certificate validation flaws despite the narrow attack vector.

Frequently asked questions