CVE-2026-5448
mediumX.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore.
Vendor / product: Wolfssl — wolfssl
X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. A buffer overflow may occur when parsing date fields from a crafted X.509 certificate via the compatibility layer API. This is only triggered when calling these two APIs directly from an application, and does not affect TLS or certificate verify operations in wolfSSL.
CVSS
4.3
4.3 (CVSS v3.1)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-04-10 00:16
Modified: 2026-11-11 23:10
NVD status: Analyzed
Last synced 3 hours ago
Verified against the source API 2026-11-11 23:12 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
wolfssl / wolfssl <5.9.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/wolfSSL/wolfssl/pull/10071
References
- https://github.com/wolfSSL/wolfssl/pull/10071 facts@wolfssl.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-11 23:12 UTC · record ↗