CVE-2026-6450

MediumCVSS 5.3/10Last modified Jun 27, 2026

Description

A CRL critical extension bypass exists in ParseCRL_Extensions where critical extensions are not properly enforced, allowing a crafted CRL with an unhandled critical extension to be accepted. This only affects builds with CRL support enabled and where a crafted CRL had a trusted signature when parsed.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-295

Affected software

VendorProductVersions
wolfSSLwolfSSL>= 4.3.0, <= 5.9.1

References

Timeline

Published
Jun 25, 2026
Last modified
Jun 27, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-64500In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the CVE-2026-645017.1In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix CS held asserted and state leaks In ad_sCVE-2026-645027.8In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix clear_pending_event for registerless deviCVE-2026-64503In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error kxsd9CVE-2026-645045.5In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count __bmc15CVE-2026-645055.5In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a lengthCVE-2026-645065.5In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previouCVE-2026-645075.5In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening agaCVE-2026-645085.5In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator CVE-2026-645095.5In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build() still hCVE-2026-64514.3The cms-fuer-motorrad-werkstaetten plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.0. TCVE-2026-645107.0In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init
CVE-2026-6450: Medium severity, CVSS 5.3 | Vulnix