CVE-2026-10098: OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status
OCSP CertID serial-number length-confusion in wolfSSLOCSPrespfindstatus allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared serial-number bytes without first requiring the two serial numbers to be of equal length, so a SingleResponse for one certificate (same issuer) whose serial is a prefix of the target's serial would match, returning the wrong certificate's status. The fix requires the serial lengths to be equal before comparing the serial bytes.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10098?
CVE-2026-10098 has a medium severity rating of 6.3.
How do I fix CVE-2026-10098?
To fix CVE-2026-10098, apply the available patch provided by wolfSSL.
What does CVE-2026-10098 affect?
CVE-2026-10098 affects the wolfSSL library, specifically the wolfSSL_OCSP_resp_find_status function.
What type of vulnerability is CVE-2026-10098?
CVE-2026-10098 is a length-confusion vulnerability in the OCSP CertID serial number.
What is the impact of CVE-2026-10098?
The impact of CVE-2026-10098 is that it can falsely report the revocation status of a certificate due to serial number prefix confusion.