CVE-2026-3548

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3548", "assignerOrgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27", "state": "PUBLISHED", "assignerShortName": "wolfSSL", "dateReserved": "2026-03-04T18:42:04.494Z", "datePublished": "2026-03-19T17:45:16.717Z", "dateUpdated": "2026-03-19T18:00:53.844Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27", "shortName": "wolfSSL", "dateUpdated": "2026-03-19T17:45:16.717Z"}, "title": "Buffer overflow in CRL number parsing in wolfSSL", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "affected": [{"vendor": "wolfSSL", "product": "wolfSSL", "platforms": ["MacOS", "Linux", "Windows"], "collectionURL": "https://www.wolfssl.com/download/", "packageName": "wolfSSL", "repo": "https://github.com/wolfSSL/wolfssl", "modules": ["wolfSSL"], "programFiles": ["wolfcrypt/src/asn.c"], "programRoutines": [{"name": "ParseCRL()"}, {"name": "ParseCRL_Extensions()"}], "versions": [{"status": "affected", "version": "0", "lessThan": "5.9.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storing the CRL number as a hexadecimal string, and a stack-based overflow for sufficiently sized CRL numbers. With appropriately crafted CRLs, either of these out of bound writes could be triggered. Note this only affects builds that specifically enable CRL support, and the user would need to load a CRL from an untrusted source.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storing the CRL number as a hexadecimal string, and a stack-based overflow for sufficiently sized CRL numbers. With appropriately crafted CRLs, either of these out of bound writes could be triggered. Note this only affects builds that specifically enable CRL support, and the user would need to load a CRL from an untrusted source.</p>"}]}], "references": [{"url": "https://github.com/wolfSSL/wolfssl/pull/9628/"}, {"url": "https://github.com/wolfSSL/wolfssl/pull/9873/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"}}], "workarounds": [{"lang": "en", "value": "Disabling CRL processing is the only effective workaround for this issue. Preventing the overflow by validating the CRL number length requires source code modification and therefore should be considered a fix rather than a workaround.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Disabling CRL processing is the only effective workaround for this issue. Preventing the overflow by validating the CRL number length requires source code modification and therefore should be considered a fix rather than a workaround."}]}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T18:00:17.636946Z", "id": "CVE-2026-3548", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T18:00:53.844Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3548", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-19T18:00:17.636946Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T18:00:45.496Z"}}], "cna": {"title": "Buffer overflow in CRL number parsing in wolfSSL", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/wolfSSL/wolfssl", "vendor": "wolfSSL", "modules": ["wolfSSL"], "product": "wolfSSL", "versions": [{"status": "affected", "version": "0", "lessThan": "5.9.0", "versionType": "semver"}], "platforms": ["MacOS", "Linux", "Windows"], "packageName": "wolfSSL", "programFiles": ["wolfcrypt/src/asn.c"], "collectionURL": "https://www.wolfssl.com/download/", "defaultStatus": "unaffected", "programRoutines": [{"name": "ParseCRL()"}, {"name": "ParseCRL_Extensions()"}]}], "references": [{"url": "https://github.com/wolfSSL/wolfssl/pull/9628/"}, {"url": "https://github.com/wolfSSL/wolfssl/pull/9873/"}], "workarounds": [{"lang": "en", "value": "Disabling CRL processing is the only effective workaround for this issue. Preventing the overflow by validating the CRL number length requires source code modification and therefore should be considered a fix rather than a workaround.", "supportingMedia": [{"type": "text/html", "value": "Disabling CRL processing is the only effective workaround for this issue. Preventing the overflow by validating the CRL number length requires source code modification and therefore should be considered a fix rather than a workaround.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storing the CRL number as a hexadecimal string, and a stack-based overflow for sufficiently sized CRL numbers. With appropriately crafted CRLs, either of these out of bound writes could be triggered. Note this only affects builds that specifically enable CRL support, and the user would need to load a CRL from an untrusted source.", "supportingMedia": [{"type": "text/html", "value": "<p>Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storing the CRL number as a hexadecimal string, and a stack-based overflow for sufficiently sized CRL numbers. With appropriately crafted CRLs, either of these out of bound writes could be triggered. Note this only affects builds that specifically enable CRL support, and the user would need to load a CRL from an untrusted source.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27", "shortName": "wolfSSL", "dateUpdated": "2026-03-19T17:45:16.717Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3548", "state": "PUBLISHED", "dateUpdated": "2026-03-19T18:00:53.844Z", "dateReserved": "2026-03-04T18:42:04.494Z", "assignerOrgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27", "datePublished": "2026-03-19T17:45:16.717Z", "assignerShortName": "wolfSSL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.wolfssl.com/download/", "defaultStatus": "unaffected", "modules": ["wolfSSL"], "packageName": "wolfSSL", "platforms": ["MacOS", "Linux", "Windows"], "product": "wolfSSL", "programFiles": ["wolfcrypt/src/asn.c"], "programRoutines": [{"name": "ParseCRL()"}, {"name": "ParseCRL_Extensions()"}], "repo": "https://github.com/wolfSSL/wolfssl", "vendor": "wolfSSL", "versions": [{"lessThan": "5.9.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "facts@wolfssl.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA3FA1CB-CEDC-4D49-9ECD-99BBF1602312", "versionEndExcluding": "5.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storing the CRL number as a hexadecimal string, and a stack-based overflow for sufficiently sized CRL numbers. With appropriately crafted CRLs, either of these out of bound writes could be triggered. Note this only affects builds that specifically enable CRL support, and the user would need to load a CRL from an untrusted source."}, {"lang": "es", "value": "Dos vulnerabilidades de desbordamiento de b\u00fafer exist\u00edan en el analizador CRL de wolfSSL al analizar n\u00fameros CRL: un desbordamiento de b\u00fafer basado en mont\u00edculo podr\u00eda ocurrir al almacenar incorrectamente el n\u00famero CRL como una cadena hexadecimal, y un desbordamiento basado en pila para n\u00fameros CRL de tama\u00f1o suficiente. Con CRLs apropiadamente elaborados, cualquiera de estas escrituras fuera de l\u00edmites podr\u00eda ser activada. Tenga en cuenta que esto solo afecta a las compilaciones que habilitan espec\u00edficamente el soporte CRL, y el usuario necesitar\u00eda cargar un CRL de una fuente no confiable."}], "id": "CVE-2026-3548", "lastModified": "2026-06-17T10:43:46.083", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "facts@wolfssl.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3548", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-19T18:00:17.636946Z", "version": "2.0.3"}}]}, "published": "2026-03-19T18:16:22.953", "references": [{"source": "facts@wolfssl.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/wolfSSL/wolfssl/pull/9628/"}, {"source": "facts@wolfssl.com", "tags": ["Exploit", "Issue Tracking", "Patch"], "url": "https://github.com/wolfSSL/wolfssl/pull/9873/"}], "sourceIdentifier": "facts@wolfssl.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-787"}], "source": "facts@wolfssl.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": ["macos", "linux", "windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.9.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wolfSSL", "source": "cna", "vendor": "wolfSSL"}, "product": "wolfssl", "vendor": "wolfssl"}], "analysis": {"en": {"generated_at": "2026-03-19T19:50:39.389391+00:00", "value": {"mitigation_remediation": ["Disable CRL processing in wolfSSL configuration", "Verify that CRL support is not enabled in wolfSSL builds", "If a patch or update is released by wolfSSL, apply it promptly", "Monitor wolfSSL advisories for further updates"], "summary": {"action": "Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the wolfSSL library (wolfSSL:wolfSSL). It only applies to builds that enable CRL support. No specific affected versions are listed in the CNA data, so version information is unknown. The vulnerability requires that the application loads a CRL from an untrusted source.", "description_and_impact": "Two buffer overflows exist in wolfSSL's CRL parser when processing CRL numbers: a heap\u2011based overflow occurs when the CRL number is stored as a hexadecimal string incorrectly, and a stack\u2011based overflow can be triggered for sufficiently large CRL numbers. An attacker can supply a malicious CRL from an untrusted source to cause out\u2011of\u2011bounds writes, which could lead to arbitrary code execution or denial of service on the affected system. The weakness is characterized by CWE\u2011122 (Heap\u2011based Buffer Overflow) and CWE\u2011787 (Out\u2011Of\u2011Bounds Write).", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivery of a crafted CRL to a compatible application, which may be feasible in environments that accept external CRLs. The presence of a heap and stack buffer overflow means that an attacker with control over the CRL data could potentially achieve remote code execution, making the risk significant for applications that rely on wolfSSL with CRL support."}}}}, "created": "2026-03-20T08:56:31.729057+00:00", "updated": "2026-03-20T11:06:41.703110+00:00", "vendors": ["wolfssl", "wolfssl$PRODUCT$wolfssl"]}