CVE-2026-5447

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion. A heap buffer overflow occurs when converting an X.509 certificate internally due to incorrect size handling of the AuthorityKeyIdentifier extension.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-122

Affected software

VendorProductVersions
wolfSSLwolfSSL< 5.9.1

References

Timeline

Published
Apr 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-544705.3Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML External Entity Reference vulnerabilityCVE-2026-544716.5Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A CVE-2026-544727.5Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauCVE-2026-544757.5Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destCVE-2026-544775.4The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.CVE-2026-544783.7In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes'CVE-2026-544797.3The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the saCVE-2026-54484.3X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. A buffer overflow may occur when parsing date fields from a crCVE-2026-544817.5Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)CVE-2026-544836.7Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1CVE-2026-544899.8Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerCVE-2026-544906.3websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate ext
CVE-2026-5447: High severity, CVSS 7.5 | Vulnix