The vulnerability (CVE-2026-11999) exists in wolfSSL's OpenSSL compatibility mode when the X509_verify_cert() function is called with caller-supplied untrusted intermediates. If the certificate chain exceeds the verifier's maximum path depth, the verification process stops prematurely and returns success based on the last verified link rather than confirming a trust anchor. This allows an attacker to present a crafted certificate chain that bypasses trust validation. This issue only affects builds with --enable-opensslextra and manual or deferred verification through this API; native wolfSSL TLS/DTLS and default peer verification are unaffected.

Applications using wolfSSL with --enable-opensslextra that perform manual or deferred certificate verification via X509_verify_cert() and supply untrusted intermediates may accept attacker-controlled certificates without proper trust validation. This can lead to acceptance of malicious certificates, undermining TLS security. Native wolfSSL TLS/DTLS usage and default verification modes are not impacted, limiting the scope of the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using manual or deferred verification with caller-supplied untrusted intermediates in builds enabled with --enable-opensslextra. Prefer native wolfSSL TLS/DTLS usage or default TLS handshake verification (WOLFSSL_VERIFY_PEER), which are not affected by this issue.