Low 1.2Published Mar 19, 2026

CVE-2026-3229Integer Overflow in Certificate Chain Allocation

Updated under an hour ago (Oct 26, 2026, 5:10 AM ET)

Does this affect you?

It affects wofSSL wolfSSL and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for wofSSL wolfSSL

Exploited in the last 30 days

An integer overflow vulnerability existed in the static function wolfssl_add_to_chain, that caused heap corruption when certificate data was written out of bounds of an insufficiently sized certificate buffer. wolfssl_add_to_chain is called by these API: wolfSSL_CTX_add_extra_chain_cert, wolfSSL_CTX_add1_chain_cert, wolfSSL_add0_chain_cert. These API are enabled for 3rd party compatibility features: enable-opensslall, enable-opensslextra, enable-lighty, enable-stunnel, enable-nginx, enable-haproxy. This issue is not remotely exploitable, and would require that the application context loading certificates is compromised.

CVSS: 1.2 LOW (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green
Weakness (CWE): CWE-122
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: wolfSSL
NVD analysis: Analyzed
Record last updated: Mar 20, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

wofSSL wolfSSL wofssl:wolfssl (from the name)	before 5.9.0	CNA record
wolfssl wolfssl wolfssl:wolfssl	before 5.9.0	NVD

References

https://github.com/wolfSSL/wolfssl/pull/9827issue-tracking, patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.