CVE-2026-55962

TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, but it was also being applied while a post-handshake CertificateRequest was still outstanding. The check is now scoped to the initial handshake only: on the server, once a post-handshake CertificateRequest has been sent (certReqCtx is set), a peer certificate and a valid CertificateVerify are required again before the Finished is accepted, with empty-certificate handling following the configured verify mode (FAILIFNOPEERCERT) just as during first-handshake client authentication. Only affects TLS 1.3 servers built with post-handshake authentication support (WOLFSSLPOSTHANDSHAKEAUTH / --enable-postauth, included in --enable-all) that enable WOLFSSLVERIFYPOSTHANDSHAKE and request a client certificate after the handshake via wolfSSLrequestcertificate(). Clients, and servers that do not use post-handshake authentication, are unaffected.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55962.json",
    "cna_assigner": "wolfSSL",
    "cwe_ids": [
        "CWE-287"
    ]
}

References

Affected packages

Git / github.com/wolfssl/wolfssl

Affected ranges

Type

GIT

Repo

https://github.com/wolfssl/wolfssl

Events

Introduced

4fbd4fd36a21efd9d1a7e17aba390e91c78693b1

Fixed

ac01707f552c611fbd135cc723b2682b3e7f80f2

Database specific

{
    "cpe": "cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "5.5.4"
        },
        {
            "last_affected": "5.9.1"
        },
        {
            "fixed": "5.9.2"
        }
    ]
}

Affected versions

v5.*

v5.2.1

v5.5.4-stable

v5.6.0-stable

v5.6.2-stable

v5.6.3-stable

v5.6.4-stable

v5.6.6-stable

v5.7.0-stable

v5.7.2-stable

v5.7.4-stable

v5.7.6-stable

v5.8.0-stable

v5.8.2-stable

v5.8.4-stable

v5.9.0-stable

v5.9.1-stable

Other

wolfEntropy1

wolfEntropy2d

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55962.json"