DEBIAN-CVE-2026-5194

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-5194

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5194.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-5194

Upstream

CVE-2026-5194

Published

2026-04-09T20:16:28Z

Modified

2026-09-14T17:03:43Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA certificate-based authentication if the public CA key used is also known. This affects ECDSA/ECC verification when EdDSA or ML-DSA is also enabled.

References

https://security-tracker.debian.org/tracker/CVE-2026-5194

Affected packages

Debian:12 / wolfssl

Package

Name: wolfssl
Purl: pkg:deb/debian/wolfssl?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.5.4-2+deb12u3

Affected versions

5.*

5.5.4-2

5.5.4-2+deb12u1

5.5.4-2+deb12u2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5194.json"

Debian:13 / wolfssl