wolfSSL Vulnerability Hits IoT, Routers and Military Systems, Update to 5.9.1 Now

wolfSSL Vulnerability Alert 🚨

A major vulnerability (CVE-2026-5194) has been discovered in the wolfSSL library, affecting approximately 5 billion devices including routers, IoT gadgets, and military systems. This security flaw is found in the code used to encrypt data for these devices and applications, raising significant privacy concerns.

What is the Issue? 🤔

The vulnerability lies in how the library manages certificate-based authentication. This process is crucial as it ensures that a device verifies a digital ID to maintain a secure connection. According to Nicholas Carlini from Anthropic’s Frontier Red Team, wolfSSL fails to verify the size of the digest and does not check the OID, which is essential for identifying the mathematical formula used to sign the ID. This oversight could allow hackers to forge IDs, tricking devices into trusting malicious servers or files.

Severity Rating 🔴

The official security advisory has rated this vulnerability with a severity score of 10 out of 10, indicating that it does not require user interaction to exploit. It has also received a 9.3 rating in the National Vulnerability Database.

Who Discovered It? 🔍

Nicholas Carlini reported this flaw after utilizing an AI-based scanning tool from Anthropic, known as Claude Mythos Preview. The wolfSSL library is widely used across various industries, including smart grids, automotive manufacturing, and aviation.

Patch Released 🔧

The vulnerability was patched in version 5.9.1, released on April 8, 2026. The update has implemented stricter checks for hash and digest sizes. However, older devices that are no longer supported may remain vulnerable, posing a significant risk.

Recommendations 🛡️

If you utilize a VPN or have smart home devices, it is crucial to install any available firmware updates to safeguard your hardware. William Wright, CEO of Closed Door Security, emphasizes that the widespread use of wolfSSL transforms this vulnerability into a major supply chain issue, as organizations often struggle to identify and patch all affected devices, particularly those that are outdated or unmonitored.

For further details, Read full article