DEBIAN-CVE-2026-94419
Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index, hash(sessionID)} into the process-global SessionCache, and ClientSessionToSession() validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the server and sent in clear, AddSessionToCache() matches any other server's session on the same ID and overwrites the client-side entry with that server's master secret, cipher suite and version, while the handle continues to resolve; nothing on the write path compares the peer, the application's server ID or the WOLFSSL_CTX. Resuming through the handle then produces an abbreviated handshake in which no Certificate message is sent, so neither chain verification nor wolfSSL_check_domain_name() runs, and the attacker is accepted as the original server for the whole of that connection. Affected builds are those leaving NO_SESSION_CACHE_REF, NO_SESSION_CACHE, NO_CLIENT_CACHE and TITAN_SESSION_CACHE all undefined, which includes a plain ./configure, --enable-opensslextra and --enable-opensslall; fifteen integration options define NO_SESSION_CACHE_REF and are therefore not affected, among them --enable-all, --enable-distro, --enable-curl, --enable-nginx, --enable-haproxy, --enable-stunnel, --enable-wpas and the rest of the OPENSSL_COMPATIBLE_DEFAULTS family, and --enable-leanpsk, --enable-leantls, --enable-lowresource and --enable-tinytls13 disable the cache outright. The applicat
DEBIAN-CVE-2026-94419
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-94419
wolfssl
Source reference: /affected/0/package/name
- Affected versions
- 5.5.4-2
Source reference:
/affected/0/versions5.5.4-2+deb12u1Source reference:
/affected/0/versions5.5.4-2+deb12u2Source reference:
/affected/0/versions5.5.4-2+deb12u3Source reference:
/affected/0/versions5.5.4-2.1Source reference:
/affected/0/versions5.6.4-1Source reference:
/affected/0/versions5.6.4-2Source reference:
/affected/0/versions5.6.6-1Source reference:
/affected/0/versions5.6.6-1.1Source reference:
/affected/0/versions5.6.6-1.2Source reference:
/affected/0/versions5.6.6-1.3Source reference:
/affected/0/versions5.6.6-1.3~exp1Source reference:
/affected/0/versions5.7.0-0.1Source reference:
/affected/0/versions5.7.0-0.2Source reference:
/affected/0/versions5.7.0-0.3Source reference:
/affected/0/versions5.7.2-0.1Source reference:
/affected/0/versions5.7.2-0.2Source reference:
/affected/0/versions5.7.2-0.3Source reference:
/affected/0/versions5.7.2-0.4Source reference:
/affected/0/versions5.8.2-1Source reference:
/affected/0/versions5.8.2-1.1Source reference:
/affected/0/versions5.8.2-1.2Source reference:
/affected/0/versions5.8.4-1Source reference:
/affected/0/versions5.9.0-0.1Source reference:
/affected/0/versions5.9.0-0.2Source reference:
/affected/0/versions5.9.1-0.1Source reference:
/affected/0/versions5.9.2-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
wolfssl
Source reference: /affected/1/package/name
- Affected versions
- 5.7.2-0.1
Source reference:
/affected/1/versions5.7.2-0.1+deb13u1Source reference:
/affected/1/versions5.7.2-0.1+deb13u2Source reference:
/affected/1/versions5.7.2-0.2Source reference:
/affected/1/versions5.7.2-0.3Source reference:
/affected/1/versions5.7.2-0.4Source reference:
/affected/1/versions5.8.2-1Source reference:
/affected/1/versions5.8.2-1.1Source reference:
/affected/1/versions5.8.2-1.2Source reference:
/affected/1/versions5.8.4-1Source reference:
/affected/1/versions5.9.0-0.1Source reference:
/affected/1/versions5.9.0-0.2Source reference:
/affected/1/versions5.9.1-0.1Source reference:
/affected/1/versions5.9.2-1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wolfssl",
"purl": "pkg:deb/debian/wolfssl?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"5.5.4-2",
"5.5.4-2+deb12u1",
"5.5.4-2+deb12u2",
"5.5.4-2+deb12u3",
"5.5.4-2.1",
"5.6.4-1",
"5.6.4-2",
"5.6.6-1",
"5.6.6-1.1",
"5.6.6-1.2",
"5.6.6-1.3",
"5.6.6-1.3~exp1",
"5.7.0-0.1",
"5.7.0-0.2",
"5.7.0-0.3",
"5.7.2-0.1",
"5.7.2-0.2",
"5.7.2-0.3",
"5.7.2-0.4",
"5.8.2-1",
"5.8.2-1.1",
"5.8.2-1.2",
"5.8.4-1",
"5.9.0-0.1",
"5.9.0-0.2",
"5.9.1-0.1",
"5.9.2-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-94419.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wolfssl",
"purl": "pkg:deb/debian/wolfssl?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"5.7.2-0.1",
"5.7.2-0.1+deb13u1",
"5.7.2-0.1+deb13u2",
"5.7.2-0.2",
"5.7.2-0.3",
"5.7.2-0.4",
"5.8.2-1",
"5.8.2-1.1",
"5.8.2-1.2",
"5.8.4-1",
"5.9.0-0.1",
"5.9.0-0.2",
"5.9.1-0.1",
"5.9.2-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-94419.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #60895 · Revision 1
- Added to Heist Feed
- Publisher date