THREATNOIR
Subscribe
Back to advisories

wolfSSL Vulnerability Hits IoT, Routers and Military Systems, Update to 5.9.1 Now

Critical vulnerability CVE-2026-5194 in wolfSSL allows attackers to forge digital certificates by bypassing signature verification across ECDSA, DSA, ML-DSA, ED25519, and ED448 algorithms. Affects approximately 5 billion devices including IoT, routers, and military systems. Legacy devices unlikely to receive patches create persistent risk across critical infrastructure.

CRITICALAdvisoryApr 16, 2026
Action required
Immediately inventory all wolfSSL deployments in your environment and prioritize patching to version 5.9.1 or later. For unpatched legacy devices, implement network segmentation and enhanced monitoring for suspicious certificate validation events.
Affected products
wolfSSLwolfSSL Inc.Red HatAnthropic
CVE IDs
CVE-2026-5194
Linked articles
Source links