CVE-2026-94418 Overview
CVE-2026-94418 is a certificate signature verification flaw [CWE-347] in wolfSSL builds compiled with WOLFSSL_SMALL_CERT_VERIFY. The ProcessPeerCertParse() function splits the signature check from the certificate parse to reduce peak memory. It then merges the signature result back only when the parse returns 0, so any parse error suppresses ASN_SIG_CONFIRM_E. An attacker on an adjacent network can forge a certificate using the expected subject, the trusted CA as issuer, a past validity window, and arbitrary signature bytes. The handshake succeeds when the application installs a verify callback that overrides date errors, such as the shipped myVerify() under VERIFY_OVERRIDE_DATE_ERR.
Critical Impact
Peers can authenticate using self-signed certificates without CA key material, provided the target build enables WOLFSSL_SMALL_CERT_VERIFY and installs a verify callback that overrides date errors.
Affected Products
- wolfSSL builds compiled with WOLFSSL_SMALL_CERT_VERIFY (off by default)
- Autotools configurations: --enable-lowresource, --enable-leantls, --enable-tinytls13=cert, --enable-tinytls13=mutualauth
- Embedded builds reaching WC_CFG_SMALL_CERT_VERIFY via examples/configs/user_settings_embedded.h
Discovery Timeline
- 2026-09-27 - CVE-2026-94418 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-94418
Vulnerability Analysis
The flaw lives in ProcessPeerCertParse() under the WOLFSSL_SMALL_CERT_VERIFY build. To conserve memory, the function runs ConfirmSignature() separately from ParseCertRelative() and then merges the two results. The merge only applies the signature outcome when the parse returns 0, so any parse-level error path never surfaces ASN_SIG_CONFIRM_E.
In the normal full-parse path, ParseCertRelative() reaches validity-date, name-constraint, and critical-extension checks only after ConfirmSignature() has passed. Splitting the signature check inverts that precedence, breaking the assumption that "override date errors" is a safe callback policy. Both TLS 1.2 and TLS 1.3 are affected in both directions, and DTLS reaches the same function.
When the forged certificate is a chain certificate, the callback's consent causes it to be cached in the WOLFSSL_CTX certificate manager. An exposed deployment must restart the context or the process rather than merely reconnect.
Root Cause
The merge logic incorrectly gates the propagation of the signature verification result on a successful parse return value. A parse error overwrites or masks the ASN_SIG_CONFIRM_E code, and the application never sees that the signature check failed.
Attack Vector
An attacker needs no PKI key material and no CA compromise. They craft a certificate carrying the expected subject name, the trusted CA's subject as its issuer, arbitrary bytes in the signature field, a validity window in the past, and the attacker's own key pair. The target must run a build defining WOLFSSL_SMALL_CERT_VERIFY and install a verify callback via wolfSSL_CTX_set_verify() or wolfSSL_set_verify() with WOLFSSL_VERIFY_PEER that returns 1 for ASN_BEFORE_DATE_E or ASN_AFTER_DATE_E. The shipped myVerify() in wolfssl/test.h under VERIFY_OVERRIDE_DATE_ERR matches this shape and is selected by examples/client -D.
For technical patch details, see wolfSSL Pull Request #11500.
Detection Methods for CVE-2026-94418
Indicators of Compromise
- Successful TLS or DTLS handshakes where the peer certificate has a validity window entirely in the past.
- Peer certificates whose issuer field matches a trusted CA subject but whose signature does not verify against that CA's public key.
- Cached peer certificates in WOLFSSL_CTX certificate managers that lack a valid signature chain.
Detection Strategies
- Audit application builds for the WOLFSSL_SMALL_CERT_VERIFY macro and for the autotools flags --enable-lowresource, --enable-leantls, and --enable-tinytls13 variants.
- Review verify callbacks for logic that returns 1 on ASN_BEFORE_DATE_E or ASN_AFTER_DATE_E, including code derived from the shipped myVerify().
- Compare handshake outcomes against wolfSSL_CertManagerVerifyBuffer() and wc_CheckCertSignature(), which continue to report ASN_SIG_CONFIRM_E correctly on the same binary.
Monitoring Recommendations
- Log full peer certificate chains at the application layer and alert on expired validity periods paired with successful handshakes.
- Monitor process and context lifecycles so that any suspected forged chain certificate triggers a context or process restart rather than a reconnect.
- Instrument TLS endpoints to record the specific verify callback return values during handshake events.
How to Mitigate CVE-2026-94418
Immediate Actions Required
- Apply the fix from wolfSSL Pull Request #11500 and rebuild all affected binaries.
- Remove verify callbacks that override ASN_BEFORE_DATE_E or ASN_AFTER_DATE_E, or replace them with callbacks that return preverify for date errors.
- Restart the WOLFSSL_CTX or the host process on any system that may have cached a forged chain certificate.
Patch Information
The upstream fix merges the ConfirmSignature() result into the final verification outcome regardless of the parse return value, ensuring ASN_SIG_CONFIRM_E surfaces to the application and verify callback. Rebuild wolfSSL from the patched source and redeploy any statically linked applications.
Workarounds
- Rebuild wolfSSL without WOLFSSL_SMALL_CERT_VERIFY, since the macro is off by default and not reachable through any CMake option.
- Avoid the autotools presets --enable-lowresource, --enable-leantls, --enable-tinytls13=cert, and --enable-tinytls13=mutualauth where feasible.
- Set WC_CFG_SMALL_CERT_VERIFY to 0 in examples/configs/user_settings_embedded.h or equivalent custom settings headers.
- Replace any callback derived from myVerify() under VERIFY_OVERRIDE_DATE_ERR with one that enforces date errors as fatal.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.