CVE-2026-94419 Overview
CVE-2026-94419 is an authentication weakness [CWE-287] in wolfSSL's process-global TLS session cache. When NO_SESSION_CACHE_REF is undefined, wolfSSL_get_session() returns a {row, index, hash(sessionID)} reference rather than a session object. Because TLS 1.2 session IDs are chosen by the server and transmitted in clear, a second server reusing the same session ID can cause AddSessionToCache() to overwrite the original client-side entry with its own master secret, cipher suite, and version. Resumption through the stale handle produces an abbreviated handshake with no Certificate message, bypassing chain verification and wolfSSL_check_domain_name().
Critical Impact
An adjacent-network attacker controlling a second TLS server can impersonate an unrelated origin server for the duration of a resumed TLS 1.2 or DTLS 1.2 session, crossing WOLFSSL_CTX boundaries within the process.
Affected Products
- wolfSSL releases v5.3.0 through v5.9.2
- Builds leaving NO_SESSION_CACHE_REF, NO_SESSION_CACHE, NO_CLIENT_CACHE, and TITAN_SESSION_CACHE all undefined
- Default ./configure, --enable-opensslextra, and --enable-opensslall builds using the legacy wolfSSL_get_session() / wolfSSL_set_session() reference flow
Discovery Timeline
- 2026-09-27 - CVE-2026-94419 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-94419
Vulnerability Analysis
The wolfSSL client-side session cache stores entries in a process-global table indexed by a server-chosen 32-byte session ID. wolfSSL_get_session() returns a lightweight handle, and ClientSessionToSession() later resolves that handle by comparing only the stored hash of the session ID. No field on the write path compares the peer address, the application-supplied server ID, or the WOLFSSL_CTX pointer. A second TLS endpoint able to influence or reuse a session ID observed on the wire can therefore cause the next successful handshake to overwrite the original entry while the handle still resolves cleanly.
Once the entry is poisoned, resumption uses the attacker's master secret and version. The abbreviated TLS 1.2 handshake sends no Certificate message, so wolfSSL_check_domain_name() and chain verification are never invoked. The attacker is accepted as the legitimate origin for the whole connection, and because the cache is process-global, the poisoned entry crosses WOLFSSL_CTX boundaries and persists until eviction or the 500-second default timeout.
Root Cause
The cache lookup authenticates only by hash(sessionID), a value the peer controls in TLS 1.2 and DTLS 1.2. Peer identity, server ID, and context pointer are not part of the write-path comparison, so entries belonging to different origins collide.
Attack Vector
The attacker must be positioned to complete a TLS 1.2 or DTLS 1.2 handshake with the vulnerable client while reusing a session ID previously observed from another server. TLS 1.3 and ticket-based resumption are not reachable because both derive the cache key from a client-chosen value. wolfSSL_get1_session() and wolfSSL_SetServerID() lookups are also unaffected.
Technical details are documented in the wolfSSL Pull Request #11500 which introduces the fix.
Detection Methods for CVE-2026-94419
Indicators of Compromise
- Abbreviated TLS 1.2 or DTLS 1.2 resumptions to endpoints the client has not previously completed a full handshake with
- Session ID collisions across unrelated server identities within a single process
- Resumed sessions whose negotiated cipher suite or TLS version differs from the original full handshake for the same server identity
Detection Strategies
- Inventory wolfSSL-linked binaries and confirm the build flags; flag any image in the v5.3.0 through v5.9.2 range built without NO_SESSION_CACHE_REF
- Instrument applications that call wolfSSL_get_session() / SSL_get_session() followed by wolfSSL_set_session() to log the server identity associated with each cached handle
- Compare peer certificate fingerprints across full and resumed handshakes for the same application-level target
Monitoring Recommendations
- Capture TLS handshake metadata (version, session ID, cipher suite) in network telemetry and alert on resumption to unexpected peers
- Track process-level cache lifetimes against the 500-second default timeout to bound exposure windows
- Correlate client-side TLS resumption events with destination IP changes to surface cross-server session reuse
How to Mitigate CVE-2026-94419
Immediate Actions Required
- Upgrade wolfSSL to a release containing the fix from Pull Request #11500, which raises WOLFSSL_CACHE_VERSION from 2 to 3
- Rebuild affected applications with NO_SESSION_CACHE_REF defined, or migrate call sites from wolfSSL_get_session() to wolfSSL_get1_session()
- Invalidate any persisted session caches; fixed builds will reject caches written by older versions due to the version bump
Patch Information
The upstream fix adds a per-write generation counter to each cache entry and bumps WOLFSSL_CACHE_VERSION to 3. The counter is checked when a handle is resolved, so an entry overwritten by an unrelated server no longer resolves through the original handle. See wolfSSL Pull Request #11500 for the implementation.
Workarounds
- Rebuild with any integration option that defines NO_SESSION_CACHE_REF, such as --enable-all, --enable-distro, --enable-curl, --enable-nginx, --enable-haproxy, --enable-stunnel, or --enable-wpas
- Disable the cache entirely using --enable-leanpsk, --enable-leantls, --enable-lowresource, or --enable-tinytls13
- Replace legacy reference flow calls with wolfSSL_get1_session(), which returns the session object itself and is not affected
- Restrict clients to TLS 1.3 or ticket-based resumption, both of which use a client-chosen cache key
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.