CVE-2026-55961CWE-347

wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer

High · published June 25, 2026

CVSS v4.0
8.2
EPSS
0%
Percentile
3.5
In the wild
Unconfirmed
What it is

wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibility-layer verify path now rejects the object when no signer signature has actually been verified, so a PKCS#7 carrying no valid signature is no longer reported as verified. This is enforced regardless of the PKCS7_NOVERIFY flag, which only suppresses signer certificate chain validation and was never intended to waive the requirement that a signature exist. Only affects OpenSSL compatibility builds that call the PKCS7_verify() compatibility API on potentially degenerate PKCS#7 bundles.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00146 · 3.5th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-06-25T16:51Z
EPSS history
Timeline
  • 25 JUN 16:51Z
    wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer
    cvelistv5