CVE-2026-55961: wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer
wolfSSLPKCS7verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibility-layer verify path now rejects the object when no signer signature has actually been verified, so a PKCS#7 carrying no valid signature is no longer reported as verified. This is enforced regardless of the PKCS7NOVERIFY flag, which only suppresses signer certificate chain validation and was never intended to waive the requirement that a signature exist. Only affects OpenSSL compatibility builds that call the PKCS7verify() compatibility API on potentially degenerate PKCS#7 bundles.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55961?
CVE-2026-55961 has a severity rating of high, with a CVSS score of 8.2.
How do I fix CVE-2026-55961?
To fix CVE-2026-55961, you should apply the available patch provided by wolfSSL.
What issue does CVE-2026-55961 describe?
CVE-2026-55961 describes a vulnerability where wolfSSL_PKCS7_verify() incorrectly reports success for degenerate PKCS#7 objects without a signer.
What are the consequences of CVE-2026-55961?
The consequences of CVE-2026-55961 include possible unauthenticated access since the verification process succeeds without any content authentication.
When was CVE-2026-55961 published?
CVE-2026-55961 was published on June 25, 2026.