{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5194.json"
      }
    ],
    "title": "wolfSSL: wolfSSL: Reduced security of ECDSA authentication via missing digest size checks",
    "tracking": {
      "current_release_date": "2026-06-28T11:10:32+00:00",
      "generator": {
        "date": "2026-06-28T11:10:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.2.6"
        }
      },
      "id": "CVE-2026-5194",
      "initial_release_date": "2026-04-09T19:30:24.095000+00:00",
      "revision_history": [
        {
          "date": "2026-04-09T19:30:24.095000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-16T20:40:26+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-06-28T11:10:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "product": {
          "name": "All currently supported Red Hat products",
          "product_id": "red_hat_products",
          "product_identification_helper": {
            "cpe": "cpe:/a:redhat"
          }
        }
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-5194",
      "discovery_date": "2026-04-09T20:02:15.827941+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_products"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in wolfSSL. Missing hash/digest size and Object Identifier (OID) checks allow the acceptance of smaller, less secure digests during the verification of Elliptic Curve Digital Signature Algorithm (ECDSA) certificates. This could enable a remote attacker, with knowledge of the public Certificate Authority (CA) key, to weaken the security of ECDSA certificate-based authentication. The vulnerability affects ECDSA/ECC verification when EdDSA or ML-DSA are also enabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "This vulnerability doesn't affect any versions of MariaDB as shipped with Red Hat Products. For Red Hat products MariaDB is compiled and linked against the system's OpenSSL library instead of using the MariaDB's bundled WolfSSL library routines.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "red_hat_products"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5194"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5194",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5194"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5194",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5194"
        },
        {
          "category": "external",
          "summary": "https://github.com/wolfSSL/wolfssl/pull/10131",
          "url": "https://github.com/wolfSSL/wolfssl/pull/10131"
        }
      ],
      "release_date": "2026-04-09T19:30:24.095000+00:00",
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "red_hat_products"
          ]
        }
      ],
      "title": "wolfSSL: wolfSSL: Reduced security of ECDSA authentication via missing digest size checks"
    }
  ]
}