--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:wolfssl
User: [email protected]
Usertags: pu
[ Reason ]
Forwarding from the Maintainer:
I would like to patch some of the CVEs for wolfssl in Trixie.
The prepared security updates fix some of the recent wolfSSL CVEs
(tracked in #1140765 and #1140815).
This is an alternative to #1136309 which has not been confirmed yet
and would fix CVE-2026-5194 as well.
[ Impact ]
The user is vulnerable to
CVE-2026-5194
CVE-2026-55962
CVE-2026-55967
CVE-2026-6092
CVE-2026-6094
CVE-2026-6329
CVE-2026-6331
CVE-2026-6678
CVE-2026-6681
CVE-2026-6731
CVE-2026-6325
CVE-2026-55961
CVE-2026-7511
CVE-2026-6450
CVE-2026-55960
[ Tests ]
As I am forwarding this, I have only checked the debdiff to compile on
trixie. The Maintainer may add his test approach.
[ Risks ]
As these are proper CVE fix backports there is much less risk than in
#1136309 which imports a newer upstream version.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in stable
[x] the issue is verified as fixed in unstable
[ Changes ]
* CVE-2026-5194: require certificate signature OID to match issuer key OID.
* CVE-2026-55960: validate negotiated certificate type for raw public keys.
* CVE-2026-55961: reject degenerate certs-only PKCS#7 in PKCS7_verify.
* CVE-2026-55962: require client cert on outstanding TLS 1.3 post-handshake
auth.
* CVE-2026-55967: reject AES-GCM cumulative size overflow in streaming update.
* CVE-2026-6092: enforce Encrypt-then-MAC on the TLS resumption path.
* CVE-2026-6094: bound encrypted content size in PKCS7 EnvelopedData.
* CVE-2026-6325: bound index in SetSuitesHashSigAlgo to prevent OOB write.
* CVE-2026-6329: reject PKCS#12 MAC length mismatch.
* CVE-2026-6331: require exact HMAC tag length in EVP_DigestVerifyFinal.
* CVE-2026-6450: reject CRLs with unrecognized critical extensions.
* CVE-2026-6678: fix integer underflow in wc_PKCS7_DecryptOri.
* CVE-2026-6681: respect caller output buffer size in PKCS7 decode.
* CVE-2026-6731: apply DNS name constraints to Subject CN when no SAN.
* CVE-2026-7511: report the verifying cert as the PKCS#7 signer.
diff -Nru wolfssl-5.7.2/debian/changelog wolfssl-5.7.2/debian/changelog
--- wolfssl-5.7.2/debian/changelog 2025-08-10 15:17:47.000000000 +0200
+++ wolfssl-5.7.2/debian/changelog 2026-07-05 23:43:31.000000000 +0200
@@ -1,3 +1,30 @@
+wolfssl (5.7.2-0.1+deb13u2) trixie-security; urgency=high
+
+ * Backport upstream security fixes. (See #1140765, #1140815)
+ * CVE-2026-5194: require certificate signature OID to match issuer key
+ OID.
+ * CVE-2026-55960: validate negotiated certificate type for raw public
+ keys.
+ * CVE-2026-55961: reject degenerate certs-only PKCS#7 in PKCS7_verify.
+ * CVE-2026-55962: require client cert on outstanding TLS 1.3 post-
+ handshake auth.
+ * CVE-2026-55967: reject AES-GCM cumulative size overflow in streaming
+ update.
+ * CVE-2026-6092: enforce Encrypt-then-MAC on the TLS resumption path.
+ * CVE-2026-6094: bound encrypted content size in PKCS7 EnvelopedData.
+ * CVE-2026-6325: bound index in SetSuitesHashSigAlgo to prevent OOB
+ write.
+ * CVE-2026-6329: reject PKCS#12 MAC length mismatch.
+ * CVE-2026-6331: require exact HMAC tag length in
+ EVP_DigestVerifyFinal.
+ * CVE-2026-6450: reject CRLs with unrecognized critical extensions.
+ * CVE-2026-6678: fix integer underflow in wc_PKCS7_DecryptOri.
+ * CVE-2026-6681: respect caller output buffer size in PKCS7 decode.
+ * CVE-2026-6731: apply DNS name constraints to Subject CN when no SAN.
+ * CVE-2026-7511: report the verifying cert as the PKCS#7 signer.
+
+ -- Jacob Barthelmeh <[email protected]> Sun, 05 Jul 2026 15:43:31 -0600
+
wolfssl (5.7.2-0.1+deb13u1) trixie; urgency=medium
* Fix CVE-2025-7394: weak/predictable random numbers. (Closes: #1109549)
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-5194-digest-sizes.patch
wolfssl-5.7.2/debian/patches/CVE-2026-5194-digest-sizes.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-5194-digest-sizes.patch
1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-5194-digest-sizes.patch
2026-07-05 23:43:31.000000000 +0200
@@ -0,0 +1,382 @@
+Description: CVE-2026-5194 - enforce minimum/maximum digest sizes in signature
ops
+ Companion to CVE-2026-5194.patch (asn.c signature-OID match). Backports the
+ wolfcrypt-level digest-size enforcement half of upstream commit abce5be9: adds
+ WC_MIN_DIGEST_SIZE (hash.h) and rejects too-small/too-large hash inputs in the
+ ECC and DSA sign/verify primitives, the Ed25519ph/Ed448ph prehash length,
+ wc_SignatureVerifyHash and the PKCS7 ECDSA verify path. The upstream
internal.c
+ EccVerify guard is omitted: it is redundant (EccVerify calls the now-guarded
+ wc_ecc_verify_hash) and its context mis-binds to Ed25519Sign on 5.7.2. The
+ enum->define header refactor, kernel module port, dilithium (not built) and
+ test-only hunks are likewise omitted.
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/abce5be989ccd0665e2b9445abb856886975dfd1
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-5194
+Author: wolfSSL
+Forwarded: not-needed
+Index: wolfssl-5.7.2/wolfcrypt/src/dsa.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/dsa.c
++++ wolfssl-5.7.2/wolfcrypt/src/dsa.c
+@@ -34,6 +34,7 @@
+ #include <wolfssl/wolfcrypt/logging.h>
+ #include <wolfssl/wolfcrypt/sha.h>
+ #include <wolfssl/wolfcrypt/dsa.h>
++#include <wolfssl/wolfcrypt/hash.h>
+
+ #ifdef NO_INLINE
+ #include <wolfssl/wolfcrypt/misc.h>
+@@ -680,6 +681,12 @@ int wc_DsaSign_ex(const byte* digest, wo
+ if (digest == NULL || out == NULL || key == NULL || rng == NULL)
+ return BAD_FUNC_ARG;
+
++ if ((digestSz > WC_MAX_DIGEST_SIZE) ||
++ (digestSz < WC_MIN_DIGEST_SIZE))
++ {
++ return BAD_LENGTH_E;
++ }
++
+ SAVE_VECTOR_REGISTERS(return _svr_ret;);
+
+ do {
+@@ -1013,6 +1020,16 @@ int wc_DsaVerify_ex(const byte* digest,
+ if (digest == NULL || sig == NULL || key == NULL || answer == NULL)
+ return BAD_FUNC_ARG;
+
++ /* Note the min allowed digestSz here is WC_SHA_DIGEST_SIZE, not
++ * WC_MIN_DIGEST_SIZE, to allow verify-only legacy DSA operations, as
++ * expressly allowed under FIPS 186-5, FIPS 140-3, and SP 800-131A.
++ */
++ if ((digestSz > WC_MAX_DIGEST_SIZE) ||
++ (digestSz < WC_SHA_DIGEST_SIZE))
++ {
++ return BAD_LENGTH_E;
++ }
++
+ do {
+ #ifdef WOLFSSL_SMALL_STACK
+ w = (mp_int *)XMALLOC(sizeof *w, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+Index: wolfssl-5.7.2/wolfcrypt/src/ecc.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/ecc.c
++++ wolfssl-5.7.2/wolfcrypt/src/ecc.c
+@@ -6726,6 +6726,11 @@ int wc_ecc_sign_hash(const byte* in, wor
+ if (in == NULL || out == NULL || outlen == NULL || key == NULL) {
+ return ECC_BAD_ARG_E;
+ }
++ if ((inlen > WC_MAX_DIGEST_SIZE) ||
++ (inlen < WC_MIN_DIGEST_SIZE))
++ {
++ return BAD_LENGTH_E;
++ }
+
+ #ifdef WOLF_CRYPTO_CB
+ #ifndef WOLF_CRYPTO_CB_FIND
+@@ -7224,6 +7229,11 @@ int wc_ecc_sign_hash_ex(const byte* in,
+ if (in == NULL || r == NULL || s == NULL || key == NULL || rng == NULL) {
+ return ECC_BAD_ARG_E;
+ }
++ if ((inlen > WC_MAX_DIGEST_SIZE) ||
++ (inlen < WC_MIN_DIGEST_SIZE))
++ {
++ return BAD_LENGTH_E;
++ }
+
+ /* is this a private key? */
+ if (key->type != ECC_PRIVATEKEY && key->type != ECC_PRIVATEKEY_ONLY) {
+@@ -8466,6 +8476,12 @@ int wc_ecc_verify_hash(const byte* sig,
+ return ECC_BAD_ARG_E;
+ }
+
++ /* Check hash length */
++ if ((hashlen > WC_MAX_DIGEST_SIZE) ||
++ (hashlen < WC_MIN_DIGEST_SIZE)) {
++ return BAD_LENGTH_E;
++ }
++
+ #ifdef WOLF_CRYPTO_CB
+ #ifndef WOLF_CRYPTO_CB_FIND
+ if (key->devId != INVALID_DEVID)
+@@ -9073,6 +9089,12 @@ int wc_ecc_verify_hash_ex(mp_int *r, mp_
+ if (r == NULL || s == NULL || hash == NULL || res == NULL || key == NULL)
+ return ECC_BAD_ARG_E;
+
++ /* Check hash length */
++ if ((hashlen > WC_MAX_DIGEST_SIZE) ||
++ (hashlen < WC_MIN_DIGEST_SIZE)) {
++ return BAD_LENGTH_E;
++ }
++
+ /* default to invalid signature */
+ *res = 0;
+
+Index: wolfssl-5.7.2/wolfcrypt/src/ed25519.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/ed25519.c
++++ wolfssl-5.7.2/wolfcrypt/src/ed25519.c
+@@ -396,6 +396,12 @@ int wc_ed25519_sign_msg_ex(const byte* i
+ return BAD_FUNC_ARG;
+ }
+
++ if ((type == Ed25519ph) &&
++ (inLen != WC_SHA512_DIGEST_SIZE))
++ {
++ return BAD_LENGTH_E;
++ }
++
+ #ifdef WOLF_CRYPTO_CB
+ if (key->devId != INVALID_DEVID) {
+ ret = wc_CryptoCb_Ed25519Sign(in, inLen, out, outLen, key, type,
+@@ -854,6 +860,12 @@ int wc_ed25519_verify_msg_ex(const byte*
+ (context == NULL && contextLen != 0))
+ return BAD_FUNC_ARG;
+
++ if ((type == Ed25519ph) &&
++ (msgLen != WC_SHA512_DIGEST_SIZE))
++ {
++ return BAD_LENGTH_E;
++ }
++
+ #ifdef WOLF_CRYPTO_CB
+ if (key->devId != INVALID_DEVID) {
+ ret = wc_CryptoCb_Ed25519Verify(sig, sigLen, msg, msgLen, res, key,
+Index: wolfssl-5.7.2/wolfcrypt/src/ed448.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/ed448.c
++++ wolfssl-5.7.2/wolfcrypt/src/ed448.c
+@@ -374,6 +374,11 @@ int wc_ed448_sign_msg_ex(const byte* in,
+ ret = BAD_FUNC_ARG;
+ }
+
++ if ((ret == 0) && (type == Ed448ph) && (inLen != ED448_PREHASH_SIZE))
++ {
++ ret = BAD_LENGTH_E;
++ }
++
+ /* check and set up out length */
+ if ((ret == 0) && (*outLen < ED448_SIG_SIZE)) {
+ *outLen = ED448_SIG_SIZE;
+@@ -799,6 +804,12 @@ int wc_ed448_verify_msg_ex(const byte* s
+ if (key == NULL)
+ return BAD_FUNC_ARG;
+
++ if ((type == Ed448ph) &&
++ (msgLen != ED448_PREHASH_SIZE))
++ {
++ return BAD_LENGTH_E;
++ }
++
+ #ifdef WOLFSSL_ED448_PERSISTENT_SHA
+ sha = &key->sha;
+ #else
+Index: wolfssl-5.7.2/wolfcrypt/src/hash.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/hash.c
++++ wolfssl-5.7.2/wolfcrypt/src/hash.c
+@@ -405,6 +405,12 @@ int wc_HashGetDigestSize(enum wc_HashTyp
+ #endif
+ break;
+ case WC_HASH_TYPE_BLAKE2B:
++ #if defined(HAVE_BLAKE2B)
++ dig_size = BLAKE2B_OUTBYTES;
++ #else
++ dig_size = HASH_TYPE_E;
++ #endif
++ break;
+ case WC_HASH_TYPE_BLAKE2S:
+ #if defined(HAVE_BLAKE2) || defined(HAVE_BLAKE2S)
+ dig_size = BLAKE2S_OUTBYTES;
+@@ -524,6 +530,12 @@ int wc_HashGetBlockSize(enum wc_HashType
+ #endif
+ break;
+ case WC_HASH_TYPE_BLAKE2B:
++ #if defined(HAVE_BLAKE2B)
++ block_size = BLAKE2B_BLOCKBYTES;
++ #else
++ block_size = HASH_TYPE_E;
++ #endif
++ break;
+ case WC_HASH_TYPE_BLAKE2S:
+ #if defined(HAVE_BLAKE2) || defined(HAVE_BLAKE2S)
+ block_size = BLAKE2S_BLOCKBYTES;
+Index: wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/pkcs7.c
++++ wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+@@ -4107,6 +4107,12 @@ static int wc_PKCS7_EcdsaVerify(PKCS7* p
+ if (pkcs7 == NULL || sig == NULL)
+ return BAD_FUNC_ARG;
+
++ /* Check hash length */
++ if ((hashSz > WC_MAX_DIGEST_SIZE) ||
++ (hashSz < WC_MIN_DIGEST_SIZE)) {
++ return BAD_LENGTH_E;
++ }
++
+ #ifdef WOLFSSL_SMALL_STACK
+ digest = (byte*)XMALLOC(MAX_PKCS7_DIGEST_SZ, pkcs7->heap,
+ DYNAMIC_TYPE_TMP_BUFFER);
+Index: wolfssl-5.7.2/wolfcrypt/src/signature.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/signature.c
++++ wolfssl-5.7.2/wolfcrypt/src/signature.c
+@@ -151,6 +151,35 @@ int wc_SignatureVerifyHash(
+ WOLFSSL_MSG("wc_SignatureVerify: Invalid hash type/len");
+ return ret;
+ }
++
++#if !defined(NO_RSA) && !defined(WOLFSSL_RSA_PUBLIC_ONLY)
++ /* For WC_SIGNATURE_TYPE_RSA_W_ENC, we need to extract the actual size of
++ * the ASN.1-encoded hash.
++ */
++ if (sig_type == WC_SIGNATURE_TYPE_RSA_W_ENC) {
++ int hash_dec_len;
++ word32 idx = 0;
++ if (GetSequence(hash_data, &idx, &hash_dec_len, hash_len) < 0)
++ return ASN_PARSE_E;
++ /* skip the AlgorithmIdentifier */
++ if (GetSequence(hash_data, &idx, &hash_dec_len, hash_len) < 0)
++ return ASN_PARSE_E;
++ idx += (word32)hash_dec_len;
++ /* now sitting at the OCTET STRING containing the digest */
++ if (GetOctetString(hash_data, &idx, &hash_dec_len, hash_len) < 0)
++ return ASN_PARSE_E;
++ if (hash_dec_len != ret)
++ return BAD_LENGTH_E;
++ }
++ else
++#endif
++ {
++ if (hash_len != (word32)ret) {
++ WOLFSSL_MSG("wc_SignatureVerify: Invalid hash size");
++ return BAD_LENGTH_E;
++ }
++ }
++
+ ret = 0;
+
+ /* Verify signature using hash */
+Index: wolfssl-5.7.2/wolfssl/wolfcrypt/hash.h
+===================================================================
+--- wolfssl-5.7.2.orig/wolfssl/wolfcrypt/hash.h
++++ wolfssl-5.7.2/wolfssl/wolfcrypt/hash.h
+@@ -156,6 +156,87 @@ typedef union {
+ #define WC_MAX_BLOCK_SIZE 128
+ #endif
+
++#if defined(WC_HASH_CUSTOM_MAX_DIGEST_SIZE) && \
++ defined(WC_HASH_CUSTOM_MIN_DIGEST_SIZE)
++ #if WC_HASH_CUSTOM_MAX_DIGEST_SIZE < \
++ WC_HASH_CUSTOM_MIN_DIGEST_SIZE
++ #error HASH_CUSTOM_MAX_DIGEST_SIZE < WC_HASH_CUSTOM_MIN_DIGEST_SIZE
++ #endif
++#endif
++#ifdef WC_HASH_CUSTOM_MAX_DIGEST_SIZE
++ #undef WC_MAX_DIGEST_SIZE
++ #define WC_MAX_DIGEST_SIZE WC_HASH_CUSTOM_MAX_DIGEST_SIZE
++#endif
++#ifdef WC_HASH_CUSTOM_MAX_BLOCK_SIZE
++ #undef WC_MAX_BLOCK_SIZE
++ #define WC_MAX_BLOCK_SIZE WC_HASH_CUSTOM_MAX_BLOCK_SIZE
++#endif
++
++/* wolfssl 5.7.2 md2.h/md4.h predate the WC_-prefixed digest-size names used
by
++ * the cascade below (they define only MD2_DIGEST_SIZE/MD4_DIGEST_SIZE).
Provide
++ * the WC_-prefixed aliases so the upstream enforcement compiles unchanged. */
++#if defined(WOLFSSL_MD2) && !defined(WC_MD2_DIGEST_SIZE)
++ #define WC_MD2_DIGEST_SIZE 16
++#endif
++#if !defined(NO_MD4) && !defined(WC_MD4_DIGEST_SIZE)
++ #define WC_MD4_DIGEST_SIZE 16
++#endif
++#if defined(WC_HASH_CUSTOM_MIN_DIGEST_SIZE)
++ #if defined(WC_FIPS_186_5_PLUS) && \
++ (WC_HASH_CUSTOM_MIN_DIGEST_SIZE < 224 / 8)
++ #error FIPS 186-5 requires a minimum hash size >= SHA-224.
++ #elif defined(WC_FIPS_186_4) && \
++ (WC_HASH_CUSTOM_MIN_DIGEST_SIZE < 160 / 8)
++ #error FIPS 186-4 requires a minimum hash size >= SHA-1.
++ #elif (WC_HASH_CUSTOM_MIN_DIGEST_SIZE < 128 / 8)
++ #error WC_HASH_CUSTOM_MIN_DIGEST_SIZE is too small.
++ #endif
++ /* Let the user override the minimum digest size */
++ #define WC_MIN_DIGEST_SIZE WC_HASH_CUSTOM_MIN_DIGEST_SIZE
++#elif defined(WOLFSSL_MD2) && !defined(WC_FIPS_186_4_PLUS)
++ #define WC_MIN_DIGEST_SIZE WC_MD2_DIGEST_SIZE /* 16 */
++#elif !defined(NO_MD4) && !defined(WC_FIPS_186_4_PLUS)
++ #define WC_MIN_DIGEST_SIZE WC_MD4_DIGEST_SIZE /* 16 */
++#elif !defined(NO_MD5) && !defined(WC_FIPS_186_4_PLUS)
++ #define WC_MIN_DIGEST_SIZE WC_MD5_DIGEST_SIZE /* 16 */
++#elif !defined(NO_SHA) && !defined(WC_FIPS_186_5_PLUS)
++ #define WC_MIN_DIGEST_SIZE WC_SHA_DIGEST_SIZE /* 20 */
++#elif defined(WOLFSSL_SHA224)
++ #define WC_MIN_DIGEST_SIZE WC_SHA224_DIGEST_SIZE
++#elif !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) && \
++ defined(WOLFSSL_SHA512) && !defined(WOLFSSL_NOSHA512_224)
++ #define WC_MIN_DIGEST_SIZE WC_SHA512_224_DIGEST_SIZE
++#elif defined(WOLFSSL_SHA3) && !defined(WOLFSSL_NOSHA3_224)
++ #define WC_MIN_DIGEST_SIZE WC_SHA3_224_DIGEST_SIZE
++#elif !defined(NO_SHA256)
++ #define WC_MIN_DIGEST_SIZE WC_SHA256_DIGEST_SIZE
++#elif !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) && \
++ defined(WOLFSSL_SHA512) && !defined(WOLFSSL_NOSHA512_256)
++ #define WC_MIN_DIGEST_SIZE WC_SHA512_256_DIGEST_SIZE
++#elif defined(WOLFSSL_SHA3) && !defined(WOLFSSL_NOSHA3_256)
++ #define WC_MIN_DIGEST_SIZE WC_SHA3_256_DIGEST_SIZE
++#elif defined(HAVE_BLAKE2S)
++ #define WC_MIN_DIGEST_SIZE BLAKE2S_OUTBYTES /* 32 */
++#elif defined(WOLFSSL_SM3)
++ #define WC_MIN_DIGEST_SIZE WC_SM3_DIGEST_SIZE /* 32 */
++#elif defined(WOLFSSL_SHA384)
++ #define WC_MIN_DIGEST_SIZE WC_SHA384_DIGEST_SIZE
++#elif defined(WOLFSSL_SHA3) && !defined(WOLFSSL_NOSHA3_384)
++ #define WC_MIN_DIGEST_SIZE WC_SHA3_384_DIGEST_SIZE
++#elif defined(WOLFSSL_SHA512)
++ #define WC_MIN_DIGEST_SIZE WC_SHA512_DIGEST_SIZE
++#elif defined(WOLFSSL_SHA3) && !defined(WOLFSSL_NOSHA3_512)
++ #define WC_MIN_DIGEST_SIZE WC_SHA3_512_DIGEST_SIZE
++#elif defined(HAVE_BLAKE2B)
++ #define WC_MIN_DIGEST_SIZE BLAKE2B_OUTBYTES /* 64 */
++#elif defined(WOLFSSL_SHAKE128) || defined(WOLFSSL_SHAKE256)
++ #error SHAKE enabled without SHA-3.
++ #define WC_MIN_DIGEST_SIZE 64
++#else
++ #error No builtin hashes enabled and no WC_HASH_CUSTOM_MIN_DIGEST_SIZE.
++ #define WC_MIN_DIGEST_SIZE 64
++#endif
++
+ #if !defined(NO_ASN) || !defined(NO_DH) || defined(HAVE_ECC)
+ WOLFSSL_API int wc_HashGetOID(enum wc_HashType hash_type);
+ WOLFSSL_API enum wc_HashType wc_OidGetHash(int oid);
+Index: wolfssl-5.7.2/wolfssl/wolfcrypt/settings.h
+===================================================================
+--- wolfssl-5.7.2.orig/wolfssl/wolfcrypt/settings.h
++++ wolfssl-5.7.2/wolfssl/wolfcrypt/settings.h
+@@ -460,6 +460,29 @@
+ #define SIZEOF_LONG_LONG 8
+ #endif
+
++#if defined(HAVE_FIPS) && !defined(WC_FIPS_186_5) && !defined(WC_FIPS_186_4)
++ #if FIPS_VERSION3_GE(7,0,0)
++ #ifndef WC_FIPS_186_5
++ #define WC_FIPS_186_5
++ #endif
++ #else
++ #ifndef WC_FIPS_186_4
++ #define WC_FIPS_186_4
++ #endif
++ #endif
++#endif
++#if defined(WC_FIPS_186_4) && defined(WC_FIPS_186_5)
++ #error Conflicting FIPS 186 settings.
++#endif
++#if (defined(WC_FIPS_186_4) || defined(WC_FIPS_186_5)) && \
++ !defined(WC_FIPS_186_4_PLUS)
++ #define WC_FIPS_186_4_PLUS
++#endif
++#if defined(WC_FIPS_186_5) && !defined(WC_FIPS_186_5_PLUS)
++ #define WC_FIPS_186_5_PLUS
++#endif
++
++
+ #ifdef HAVE_NETX
+ #ifdef NEED_THREADX_TYPES
+ #include <types.h>
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-5194.patch
wolfssl-5.7.2/debian/patches/CVE-2026-5194.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-5194.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-5194.patch 2026-07-05
23:33:37.000000000 +0200
@@ -0,0 +1,142 @@
+Description: CVE-2026-5194 - require certificate signature OID to match issuer
key OID
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/abce5be989ccd0665e2b9445abb856886975dfd1
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-5194
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/asn.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/asn.c
++++ wolfssl-5.7.2/wolfcrypt/src/asn.c
+@@ -16545,6 +16545,118 @@ static int HashForSignature(const byte*
+ }
+ #endif /* !NO_ASN_CRYPT && !NO_HASH_WRAPPER */
+
++/* The certificate's signatureAlgorithm (sigOID) must match the issuer's
++ * key type (keyOID). sigOID picks the pre-hash; keyOID picks the
++ * verifier. They need to agree or the verifier gets the wrong input. */
++static int SigOidMatchesKeyOid(word32 sigOID, word32 keyOID)
++{
++ switch (keyOID) {
++ #ifndef NO_RSA
++ case RSAk:
++ switch (sigOID) {
++ case CTC_MD2wRSA:
++ case CTC_MD5wRSA:
++ case CTC_SHAwRSA:
++ case CTC_SHA224wRSA:
++ case CTC_SHA256wRSA:
++ case CTC_SHA384wRSA:
++ case CTC_SHA512wRSA:
++ case CTC_SHA3_224wRSA:
++ case CTC_SHA3_256wRSA:
++ case CTC_SHA3_384wRSA:
++ case CTC_SHA3_512wRSA:
++ case CTC_RSASSAPSS:
++ return 1;
++ }
++ return 0;
++ #ifdef WC_RSA_PSS
++ case RSAPSSk:
++ return (sigOID == CTC_RSASSAPSS);
++ #endif
++ #endif
++ #if !defined(NO_DSA) && !defined(HAVE_SELFTEST)
++ case DSAk:
++ switch (sigOID) {
++ case CTC_SHAwDSA:
++ case CTC_SHA256wDSA:
++ return 1;
++ }
++ return 0;
++ #endif
++ #if defined(HAVE_ECC) && defined(HAVE_ECC_VERIFY)
++ case ECDSAk:
++ #if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3)
++ case SM2k:
++ #endif
++ switch (sigOID) {
++ case CTC_SHAwECDSA:
++ case CTC_SHA224wECDSA:
++ case CTC_SHA256wECDSA:
++ case CTC_SHA384wECDSA:
++ case CTC_SHA512wECDSA:
++ case CTC_SHA3_224wECDSA:
++ case CTC_SHA3_256wECDSA:
++ case CTC_SHA3_384wECDSA:
++ case CTC_SHA3_512wECDSA:
++ #if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3)
++ case CTC_SM3wSM2:
++ #endif
++ return 1;
++ }
++ return 0;
++ #endif
++ #if defined(HAVE_ED25519) && defined(HAVE_ED25519_KEY_IMPORT)
++ case ED25519k:
++ return (sigOID == CTC_ED25519);
++ #endif
++ #if defined(HAVE_ED448) && defined(HAVE_ED448_KEY_IMPORT)
++ case ED448k:
++ return (sigOID == CTC_ED448);
++ #endif
++ #if defined(HAVE_FALCON)
++ case FALCON_LEVEL1k:
++ return (sigOID == CTC_FALCON_LEVEL1);
++ case FALCON_LEVEL5k:
++ return (sigOID == CTC_FALCON_LEVEL5);
++ #endif
++ #if defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_VERIFY) && \
++ !defined(WOLFSSL_DILITHIUM_NO_ASN1)
++ #ifdef WOLFSSL_DILITHIUM_FIPS204_DRAFT
++ case DILITHIUM_LEVEL2k:
++ return (sigOID == CTC_DILITHIUM_LEVEL2);
++ case DILITHIUM_LEVEL3k:
++ return (sigOID == CTC_DILITHIUM_LEVEL3);
++ case DILITHIUM_LEVEL5k:
++ return (sigOID == CTC_DILITHIUM_LEVEL5);
++ #endif
++ case ML_DSA_LEVEL2k:
++ return (sigOID == CTC_ML_DSA_LEVEL2);
++ case ML_DSA_LEVEL3k:
++ return (sigOID == CTC_ML_DSA_LEVEL3);
++ case ML_DSA_LEVEL5k:
++ return (sigOID == CTC_ML_DSA_LEVEL5);
++ #endif
++ #if defined(HAVE_SPHINCS)
++ case SPHINCS_FAST_LEVEL1k:
++ return (sigOID == CTC_SPHINCS_FAST_LEVEL1);
++ case SPHINCS_FAST_LEVEL3k:
++ return (sigOID == CTC_SPHINCS_FAST_LEVEL3);
++ case SPHINCS_FAST_LEVEL5k:
++ return (sigOID == CTC_SPHINCS_FAST_LEVEL5);
++ case SPHINCS_SMALL_LEVEL1k:
++ return (sigOID == CTC_SPHINCS_SMALL_LEVEL1);
++ case SPHINCS_SMALL_LEVEL3k:
++ return (sigOID == CTC_SPHINCS_SMALL_LEVEL3);
++ case SPHINCS_SMALL_LEVEL5k:
++ return (sigOID == CTC_SPHINCS_SMALL_LEVEL5);
++ #endif
++ }
++
++ /* Default to reject unknown key types */
++ (void)sigOID;
++ return 0;
++}
++
+ /* Return codes: 0=Success, Negative (see error-crypt.h), ASN_SIG_CONFIRM_E */
+ static int ConfirmSignature(SignatureCtx* sigCtx,
+ const byte* buf, word32 bufSz,
+@@ -16610,6 +16722,11 @@ static int ConfirmSignature(SignatureCtx
+
+ case SIG_STATE_HASH:
+ {
++ if (!SigOidMatchesKeyOid(sigOID, keyOID)) {
++ WOLFSSL_MSG("sigOID incompatible with issuer keyOID");
++ ERROR_OUT(ASN_SIG_OID_E, exit_cs);
++ }
++
+ #if !defined(NO_RSA) && defined(WC_RSA_PSS)
+ if (sigOID == RSAPSSk) {
+ word32 fakeSigOID = 0;
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-55960.patch
wolfssl-5.7.2/debian/patches/CVE-2026-55960.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-55960.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-55960.patch 2026-07-05
23:40:41.000000000 +0200
@@ -0,0 +1,61 @@
+Description: CVE-2026-55960 - validate negotiated certificate type for raw
public keys
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/c929798460656431bdeeffbf701a74521f403f36
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-55960
+Author: wolfSSL
+Forwarded: not-needed
+---
+Index: wolfssl-5.7.2/src/internal.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/internal.c
++++ wolfssl-5.7.2/src/internal.c
+@@ -14146,31 +14146,29 @@ PRAGMA_GCC_DIAG_POP
+ ret = ParseCertRelative(args->dCert, certType, verify, SSL_CM(ssl),
extraSigners);
+
+ #if defined(HAVE_RPK)
+- /* if cert type has negotiated with peer, confirm the cert received has
+- * the same type.
+- */
+- if (ret == 0 ) {
+- if (ssl->options.side == WOLFSSL_CLIENT_END) {
+- if (ssl->options.rpkState.received_ServerCertTypeCnt == 1) {
++ /* Confirm the received certificate's form (X.509 vs raw public key)
matches
++ * the type negotiated with the peer. A raw public key (RFC 7250) has no
++ * chain, so ParseCertRelative() accepts it without any trust
verification;
++ * it must only be accepted when RPK was negotiated for this peer. When no
++ * type was negotiated the default is X.509 (RFC 7250/8446), so an
++ * un-negotiated bare key is rejected. The negotiated type is the received
++ * server cert type (client) or the selected client cert type (server). */
++ if (ret == 0) {
++ cType = WOLFSSL_CERT_TYPE_X509;
++ if (ssl->options.side == WOLFSSL_CLIENT_END) {
++ if (ssl->options.rpkState.received_ServerCertTypeCnt == 1)
+ cType = ssl->options.rpkState.received_ServerCertTypes[0];
+- if ((cType == WOLFSSL_CERT_TYPE_RPK && !args->dCert->isRPK) ||
+- (cType == WOLFSSL_CERT_TYPE_X509 && args->dCert->isRPK)) {
+- /* cert type mismatch */
+- WOLFSSL_MSG("unsupported certificate type received");
+- ret = UNSUPPORTED_CERTIFICATE;
+- }
+- }
+ }
+ else if (ssl->options.side == WOLFSSL_SERVER_END) {
+- if (ssl->options.rpkState.received_ClientCertTypeCnt == 1) {
++ if (ssl->options.rpkState.sending_ClientCertTypeCnt == 1)
+ cType = ssl->options.rpkState.sending_ClientCertTypes[0];
+- if ((cType == WOLFSSL_CERT_TYPE_RPK && !args->dCert->isRPK) ||
+- (cType == WOLFSSL_CERT_TYPE_X509 && args->dCert->isRPK)) {
+- /* cert type mismatch */
+- WOLFSSL_MSG("unsupported certificate type received");
+- ret = UNSUPPORTED_CERTIFICATE;
+- }
+- }
++ }
++
++ if ((cType == WOLFSSL_CERT_TYPE_RPK && !args->dCert->isRPK) ||
++ (cType != WOLFSSL_CERT_TYPE_RPK && args->dCert->isRPK)) {
++ /* cert type mismatch - includes an un-negotiated raw public key
*/
++ WOLFSSL_MSG("unsupported certificate type received");
++ ret = UNSUPPORTED_CERTIFICATE;
+ }
+ }
+ #endif /* HAVE_RPK */
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-55961.patch
wolfssl-5.7.2/debian/patches/CVE-2026-55961.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-55961.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-55961.patch 2026-07-05
23:37:14.000000000 +0200
@@ -0,0 +1,31 @@
+Description: CVE-2026-55961 - reject degenerate certs-only PKCS#7 in
wolfSSL_PKCS7_verify
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/d382439c7c63c07294cf4fcece0aa56a35399d15
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-55961
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/src/ssl_p7p12.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/ssl_p7p12.c
++++ wolfssl-5.7.2/src/ssl_p7p12.c
+@@ -806,6 +806,19 @@ int wolfSSL_PKCS7_verify(PKCS7* pkcs7, W
+ if (ret != 0)
+ return WOLFSSL_FAILURE;
+
++ /* Reject a degenerate (certs-only) PKCS#7 with no verified signer. Such
an
++ * object has empty signerInfos, so wc_PKCS7_VerifySignedData() succeeds
++ * without authenticating the content. pkcs7.verifyCert is only set once a
++ * signer's signature has actually been verified, so a NULL value here
means
++ * the content carries no valid signature and must not be reported as
++ * verified - regardless of PKCS7_NOVERIFY, which only suppresses signer
++ * certificate chain validation, not the requirement that a signature
exist.
++ */
++ if (p7->pkcs7.verifyCert == NULL) {
++ WOLFSSL_MSG("PKCS7 has no verified signer (degenerate/certs-only)");
++ return WOLFSSL_FAILURE;
++ }
++
+ if ((flags & PKCS7_NOVERIFY) != PKCS7_NOVERIFY) {
+ /* Verify signer certificates */
+ if (store == NULL || store->cm == NULL) {
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-55962.patch
wolfssl-5.7.2/debian/patches/CVE-2026-55962.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-55962.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-55962.patch 2026-07-05
23:33:37.000000000 +0200
@@ -0,0 +1,44 @@
+Description: CVE-2026-55962 - require client cert on outstanding TLS1.3
post-handshake auth
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/f23544f09476d420becdfabd781eec0dd1a9c597
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-55962
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/src/tls13.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/tls13.c
++++ wolfssl-5.7.2/src/tls13.c
+@@ -10649,7 +10649,10 @@ int DoTls13Finished(WOLFSSL* ssl, const
+ #endif
+ if (
+ #ifdef WOLFSSL_POST_HANDSHAKE_AUTH
+- !ssl->options.verifyPostHandshake &&
++ /* Exempt only the initial handshake; a pending post-handshake
++ * CertificateRequest (certReqCtx != NULL) still requires a peer
++ * certificate and a valid CertificateVerify. */
++ (!ssl->options.verifyPostHandshake || ssl->certReqCtx != NULL) &&
+ #endif
+ (!ssl->options.havePeerCert || !ssl->options.havePeerVerify)) {
+ ret = NO_PEER_CERT; /* NO_PEER_VERIFY */
+@@ -12228,7 +12231,19 @@ static int SanityCheckTls13MsgReceived(W
+ */
+ if (ssl->options.verifyPeer &&
+ #ifdef WOLFSSL_POST_HANDSHAKE_AUTH
+- !ssl->options.verifyPostHandshake &&
++ /* The post-handshake-auth exemption is only valid during
++ * the initial handshake. On the server, once a
++ * post-handshake CertificateRequest is outstanding
++ * (certReqCtx != NULL), a Certificate is required again.
++ * Scoped to the server: certReqCtx means something
++ * different on the client (a received request) and the
++ * client does not process an inbound Finished in that
++ * state. Whether an empty Certificate is then accepted
++ * follows the verify mode (FAIL_IF_NO_PEER_CERT), exactly
++ * as for first-handshake client authentication. */
++ (!ssl->options.verifyPostHandshake ||
++ (ssl->options.side == WOLFSSL_SERVER_END &&
++ ssl->certReqCtx != NULL)) &&
+ #endif
+
!ssl->msgsReceived.got_certificate) {
+ WOLFSSL_MSG("Finished received out of order - "
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-55967.patch
wolfssl-5.7.2/debian/patches/CVE-2026-55967.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-55967.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-55967.patch 2026-07-05
23:33:37.000000000 +0200
@@ -0,0 +1,49 @@
+Description: CVE-2026-55967 - reject AES-GCM cumulative size overflow in
streaming update
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/5def276e07e23b7b3b5842afbe526b4d3703ce13
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-55967
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/aes.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/aes.c
++++ wolfssl-5.7.2/wolfcrypt/src/aes.c
+@@ -10001,6 +10001,18 @@ int wc_AesGcmEncryptUpdate(Aes* aes, byt
+ ret = MISSING_IV;
+ }
+
++ /* Prevent overflow of aes->cSz and ->aSz. Per NIST SP 800-38D section
++ * 5.2.1.1, the maximum allowed ciphertext limit is 2^32 - 2 blocks, but
we
++ * currently pass around the cunulative sizes in bytes as word32s, so we
++ * can't currently support the maximum allowed.
++ */
++ if ((ret == 0) &&
++ (((aes->cSz > 0xffffffff - sz)) ||
++ ((aes->aSz > 0xffffffff - authInSz))))
++ {
++ ret = AES_GCM_OVERFLOW_E;
++ }
++
+ if ((ret == 0) && aes->ctrSet && (aes->aSz == 0) && (aes->cSz == 0)) {
+ aes->invokeCtr[0]++;
+ if (aes->invokeCtr[0] == 0) {
+@@ -10147,6 +10159,18 @@ int wc_AesGcmDecryptUpdate(Aes* aes, byt
+ ret = MISSING_IV;
+ }
+
++ /* Prevent overflow of aes->cSz and ->aSz. Per NIST SP 800-38D section
++ * 5.2.1.1, the maximum allowed ciphertext limit is 2^32 - 2 blocks, but
we
++ * currently pass around the cunulative sizes in bytes as word32s, so we
++ * can't currently support the maximum allowed.
++ */
++ if ((ret == 0) &&
++ (((aes->cSz > 0xffffffff - sz)) ||
++ ((aes->aSz > 0xffffffff - authInSz))))
++ {
++ ret = AES_GCM_OVERFLOW_E;
++ }
++
+ if (ret == 0) {
+ /* Decrypt with AAD and/or cipher text. */
+ #ifdef WOLFSSL_AESNI
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6092.patch
wolfssl-5.7.2/debian/patches/CVE-2026-6092.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6092.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6092.patch 2026-07-05
23:33:37.000000000 +0200
@@ -0,0 +1,39 @@
+Description: CVE-2026-6092 - enforce Encrypt-then-MAC on TLS resumption path
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/af5369636a938faf4a79d1f550d3b206c51fafec
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6092
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/src/internal.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/internal.c
++++ wolfssl-5.7.2/src/internal.c
+@@ -37052,13 +37052,21 @@ static int DoSessionTicket(WOLFSSL* ssl,
+
+ #if defined(HAVE_TLS_EXTENSIONS) && defined(HAVE_ENCRYPT_THEN_MAC) && \
+ !defined(WOLFSSL_AEAD_ONLY)
+- if (ssl->options.encThenMac && ssl->specs.cipher_type == block) {
+- ret = TLSX_EncryptThenMac_Respond(ssl);
+- if (ret != 0)
+- goto out;
++ /* Only respond to ETM here when resumption actually succeeded;
++ * HandleTlsResumption populates ssl->specs via SetCipherSpecs
only
++ * on the success path. If resumption failed, resuming has been
++ * cleared and ssl->specs.cipher_type is still zero-initialized,
++ * so we must defer the ETM decision until after MatchSuite. */
++ if (ssl->options.resuming) {
++ if (ssl->options.encThenMac &&
++ ssl->specs.cipher_type == block) {
++ ret = TLSX_EncryptThenMac_Respond(ssl);
++ if (ret != 0)
++ goto out;
++ }
++ else
++ ssl->options.encThenMac = 0;
+ }
+- else
+- ssl->options.encThenMac = 0;
+ #endif
+ if (ssl->options.clientState == CLIENT_KEYEXCHANGE_COMPLETE) {
+ WOLFSSL_LEAVE("DoClientHello", ret);
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6094.patch
wolfssl-5.7.2/debian/patches/CVE-2026-6094.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6094.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6094.patch 2026-07-05
23:33:37.000000000 +0200
@@ -0,0 +1,23 @@
+Description: CVE-2026-6094 - bound encrypted content size in PKCS7
EnvelopedData
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/1397268aa12e2cf3f80c3acfa9b6036b809c08ef
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6094
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/pkcs7.c
++++ wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+@@ -12393,6 +12393,11 @@ WOLFSSL_API int wc_PKCS7_DecodeEnveloped
+ }
+
+ } else {
++ if ((idx + (word32)encryptedContentTotalSz) > pkiMsgSz) {
++ ret = BUFFER_E;
++ break;
++ }
++
+ /* cache encrypted content, no OCTET STRING */
+ ret = PKCS7_CacheEncryptedContent(pkcs7, &pkiMsg[idx],
+
(word32)encryptedContentTotalSz);
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6325.patch
wolfssl-5.7.2/debian/patches/CVE-2026-6325.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6325.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6325.patch 2026-07-05
23:34:07.000000000 +0200
@@ -0,0 +1,28 @@
+Description: CVE-2026-6325 - bound index in SetSuitesHashSigAlgo to prevent
OOB write
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/f540bb3ddfef89db637809392522247ce3e8200c
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6325
+Author: wolfSSL
+Forwarded: not-needed
+---
+Index: wolfssl-5.7.2/src/internal.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/internal.c
++++ wolfssl-5.7.2/src/internal.c
+@@ -27378,6 +27378,17 @@ int SetSuitesHashSigAlgo(Suites* suites,
+ break;
+ }
+ }
++ {
++ word32 needed = 2;
++#if defined(WC_RSA_PSS) && defined(WOLFSSL_TLS13)
++ if (sig_alg == rsa_pss_sa_algo)
++ needed = 4;
++#endif
++ if ((word32)idx + needed > WOLFSSL_MAX_SIGALGO) {
++ ret = 0;
++ break;
++ }
++ }
+ AddSuiteHashSigAlgo(suites->hashSigAlgo, mac_alg, sig_alg, 0,
&idx);
+ sig_alg = 0;
+ mac_alg = no_mac;
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6329.patch
wolfssl-5.7.2/debian/patches/CVE-2026-6329.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6329.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6329.patch 2026-07-05
23:33:37.000000000 +0200
@@ -0,0 +1,24 @@
+Description: CVE-2026-6329 - reject PKCS#12 MAC length mismatch
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/9c304bdc099140ad2fdc41ef2f2602af9768c8a1
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6329
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/pkcs12.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/pkcs12.c
++++ wolfssl-5.7.2/wolfcrypt/src/pkcs12.c
+@@ -652,6 +652,12 @@ static int wc_PKCS12_verify(WC_PKCS12* p
+ return ret;
+ }
+
++ if ((word32)ret != mac->digestSz) {
++ WOLFSSL_MSG("PKCS12 MAC digest size mismatch");
++ ForceZero(digest, sizeof(digest));
++ return MAC_CMP_FAILED_E;
++ }
++
+ #ifdef WOLFSSL_DEBUG_PKCS12
+ {
+ byte* p;
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6331.patch
wolfssl-5.7.2/debian/patches/CVE-2026-6331.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6331.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6331.patch 2026-07-05
23:33:38.000000000 +0200
@@ -0,0 +1,26 @@
+Description: CVE-2026-6331 - require exact HMAC tag length in
EVP_DigestVerifyFinal
+ A zero-length or truncated tag passed to wolfSSL_EVP_DigestVerifyFinal() was
+ accepted, because the length check only rejected oversized tags and an
+ XMEMCMP() of length zero returns a match. Require the supplied tag length to
+ equal the MAC length exactly.
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/0749f20c33516897d8c5e2ab083b855e2d17d665
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6331
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/evp.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/evp.c
++++ wolfssl-5.7.2/wolfcrypt/src/evp.c
+@@ -4636,9 +4636,8 @@ int wolfSSL_EVP_DigestVerifyFinal(WOLFSS
+
+ hashLen = wolfssl_mac_len(ctx->hash.hmac.macType);
+
+- if (siglen > hashLen)
++ if (hashLen == 0 || siglen != hashLen)
+ return WOLFSSL_FAILURE;
+- /* May be a truncated signature. */
+ }
+
+ if (wolfssl_evp_digest_pk_final(ctx, digest, &hashLen) <= 0)
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6450.patch
wolfssl-5.7.2/debian/patches/CVE-2026-6450.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6450.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6450.patch 2026-07-05
23:39:35.000000000 +0200
@@ -0,0 +1,29 @@
+Description: CVE-2026-6450 - reject CRLs with unrecognized critical extensions
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/857141da35b67a14a580fb26ec57af1efa68a1d9
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6450
+Author: wolfSSL
+Forwarded: not-needed
+Index: wolfssl-5.7.2/wolfcrypt/src/asn.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/asn.c
++++ wolfssl-5.7.2/wolfcrypt/src/asn.c
+@@ -38426,14 +38426,17 @@ static int ParseCRL_Extensions(DecodedCR
+ }
+ #endif
+ }
++ else if (critical) {
++ WOLFSSL_MSG("Unknown critical CRL extension");
++ ret = ASN_CRIT_EXT_E;
++ }
+ /* TODO: Parse CRL Number extension */
+- /* TODO: check criticality */
+ /* Move index on to next extension. */
+ idx += (word32)length;
+ }
+ }
+
+- if (ret < 0) {
++ if (ret < 0 && ret != ASN_CRIT_EXT_E) {
+ ret = ASN_PARSE_E;
+ }
+
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6678.patch
wolfssl-5.7.2/debian/patches/CVE-2026-6678.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6678.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6678.patch 2026-07-05
23:33:38.000000000 +0200
@@ -0,0 +1,34 @@
+Description: CVE-2026-6678 - fix integer underflow in wc_PKCS7_DecryptOri
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/84fb0f694cfaac4187c0beba4298a4a8a7995235
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6678
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/pkcs7.c
++++ wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+@@ -10861,9 +10861,21 @@ static int wc_PKCS7_DecryptOri(PKCS7* pk
+ XMEMCPY(oriOID, pkiMsg + *idx, oriOIDSz);
+ *idx += oriOIDSz;
+
++ /* Validate OID did not consume more than the SEQUENCE declared */
++ if ((*idx - tmpIdx) > (word32)seqSz) {
++ WOLFSSL_MSG("ORI oriType OID exceeds SEQUENCE boundary");
++ return ASN_PARSE_E;
++ }
++
+ /* get oriValue, increment idx */
+ oriValue = pkiMsg + *idx;
+- oriValueSz = seqSz - (*idx - tmpIdx);
++ oriValueSz = (word32)seqSz - (*idx - tmpIdx);
++
++ /* Validate oriValue region is within input buffer */
++ if (*idx > pkiMsgSz || oriValueSz > pkiMsgSz - *idx) {
++ WOLFSSL_MSG("ORI oriValue exceeds input buffer");
++ return ASN_PARSE_E;
++ }
+ *idx += oriValueSz;
+
+ /* pass oriOID and oriValue to user callback, expect back
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6681.patch
wolfssl-5.7.2/debian/patches/CVE-2026-6681.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6681.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6681.patch 2026-07-05
23:33:38.000000000 +0200
@@ -0,0 +1,34 @@
+Description: CVE-2026-6681 - respect caller output buffer size in PKCS7 decode
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/1de4020fe4f3f911641ac0477227249d4dda2157
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6681
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/pkcs7.c
++++ wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+@@ -13632,6 +13632,10 @@ authenv_atrbend:
+ }
+
+ /* copy plaintext to output */
++ if ((word32)encryptedContentSz > outputSz) {
++ ret = BUFFER_E;
++ break;
++ }
+ XMEMCPY(output, encryptedContent, encryptedContentSz);
+
+ /* free memory, zero out keys */
+@@ -14284,6 +14288,11 @@ int wc_PKCS7_DecodeEncryptedData(PKCS7*
+ }
+
+ /* copy plaintext to output */
++ if ((word32)(encryptedContentSz - padLen) > outputSz) {
++ XFREE(encryptedContent, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
++ ret = BUFFER_E;
++ break;
++ }
+ XMEMCPY(output, encryptedContent, encryptedContentSz -
padLen);
+
+ /* get implicit[1] unprotected attributes, optional */
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6731.patch
wolfssl-5.7.2/debian/patches/CVE-2026-6731.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6731.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6731.patch 2026-07-05
23:33:38.000000000 +0200
@@ -0,0 +1,30 @@
+Description: CVE-2026-6731 - apply DNS name constraints to Subject CN when no
SAN
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/e7b7fddacb4cc794e5dfc7693586d87a539f5aad
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6731
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/asn.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/asn.c
++++ wolfssl-5.7.2/wolfcrypt/src/asn.c
+@@ -18017,9 +18017,16 @@ static int ConfirmNameConstraints(Signer
+ XMEMSET(&subjectDnsName, 0, sizeof(DNS_entry));
+ switch (nameType) {
+ case ASN_DNS_TYPE:
+- /* Should it also consider CN in subject? It could use
+- * subjectDnsName too */
+ name = cert->altNames;
++
++ /* When no SAN is present, apply DNS name constraints to the
++ * Subject CN. */
++ if (cert->subjectCN != NULL && cert->altNames == NULL) {
++ subjectDnsName.next = NULL;
++ subjectDnsName.type = ASN_DNS_TYPE;
++ subjectDnsName.len = cert->subjectCNLen;
++ subjectDnsName.name = cert->subjectCN;
++ }
+ break;
+ case ASN_RFC822_TYPE:
+ /* Shouldn't it validate E= in subject as well? */
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-7511.patch
wolfssl-5.7.2/debian/patches/CVE-2026-7511.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-7511.patch 1970-01-01
01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-7511.patch 2026-07-05
23:37:14.000000000 +0200
@@ -0,0 +1,59 @@
+Description: CVE-2026-7511 - report the verifying cert as the PKCS#7 signer
+Origin: upstream,
https://github.com/wolfSSL/wolfssl/commit/b7f6e77a95bfeda306b22dd34394e49c0a6c8a8c
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-7511
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/src/ssl_p7p12.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/ssl_p7p12.c
++++ wolfssl-5.7.2/src/ssl_p7p12.c
+@@ -273,24 +273,42 @@ WOLFSSL_STACK* wolfSSL_PKCS7_get0_signer
+ WOLFSSL_X509* x509 = NULL;
+ WOLFSSL_STACK* signers = NULL;
+ WOLFSSL_PKCS7* p7 = (WOLFSSL_PKCS7*)pkcs7;
++ byte* signerCert;
++ word32 signerCertSz;
+
+ if (p7 == NULL)
+ return NULL;
+
+- /* Only PKCS#7 messages with a single cert that is the verifying
certificate
+- * is supported.
+- */
+ if (flags & PKCS7_NOINTERN) {
+ WOLFSSL_MSG("PKCS7_NOINTERN flag not supported");
+ return NULL;
+ }
+
++ /* Prefer the certificate that actually verified the signature. Falling
++ * back to singleCert (cert[0]) would let an attacker that bundles a
++ * trusted cert ahead of their own attacker cert have the trusted cert
++ * reported as the signer even though it did not produce the signature.
++ *
++ * Copy the chosen pointer into a local before passing its address to
++ * wolfSSL_d2i_X509; d2i_X509 advances *in by the DER length, and if
++ * we handed it the address of the struct field directly it would
++ * permanently corrupt the field, producing a heap-OOB read on the
++ * next use (pointer advanced, singleCertSz unchanged). */
++ if (p7->pkcs7.verifyCert != NULL && p7->pkcs7.verifyCertSz > 0) {
++ signerCert = p7->pkcs7.verifyCert;
++ signerCertSz = p7->pkcs7.verifyCertSz;
++ }
++ else {
++ signerCert = p7->pkcs7.singleCert;
++ signerCertSz = p7->pkcs7.singleCertSz;
++ }
++
+ signers = wolfSSL_sk_X509_new_null();
+ if (signers == NULL)
+ return NULL;
+
+- if (wolfSSL_d2i_X509(&x509, (const byte**)&p7->pkcs7.singleCert,
+- p7->pkcs7.singleCertSz) == NULL) {
++ if (wolfSSL_d2i_X509(&x509, (const byte**)&signerCert,
++ signerCertSz) == NULL) {
+ wolfSSL_sk_X509_pop_free(signers, NULL);
+ return NULL;
+ }
diff -Nru wolfssl-5.7.2/debian/patches/series
wolfssl-5.7.2/debian/patches/series
--- wolfssl-5.7.2/debian/patches/series 2025-08-10 15:17:47.000000000 +0200
+++ wolfssl-5.7.2/debian/patches/series 2026-07-05 23:43:31.000000000 +0200
@@ -5,3 +5,19 @@
disable-crl-monitor.patch
disable-jobserver.patch
handle-debian-files.diff
+CVE-2026-5194.patch
+CVE-2026-55962.patch
+CVE-2026-55967.patch
+CVE-2026-6092.patch
+CVE-2026-6094.patch
+CVE-2026-6329.patch
+CVE-2026-6331.patch
+CVE-2026-6678.patch
+CVE-2026-6681.patch
+CVE-2026-6731.patch
+CVE-2026-6325.patch
+CVE-2026-55961.patch
+CVE-2026-7511.patch
+CVE-2026-6450.patch
+CVE-2026-55960.patch
+CVE-2026-5194-digest-sizes.patch
--- End Message ---
