The vulnerability is a serial‑number length confusion in the OCSP routine wolfSSL_OCSP_resp_find_status. A single OCSP response whose serial number is a prefix of the target certificate’s serial can be accepted as the revocation status of that certificate. This allows a wrong revocation state to be reported, enabling an attacker to make a revoked or untrusted certificate appear valid or, conversely, make a valid certificate appear revoked.

The flaw affects the wolfSSL library, specifically any release that implements wolfSSL_OCSP_resp_find_status and has not applied the patch from pull request 10554. Applications and services that rely on wolfSSL for OCSP revocation checking are thus potentially vulnerable, regardless of the specific wolfSSL version unless the fix is included.

With a CVSS base score of 6.3 the flaw is assessed as moderately severe. The exploit does not require local privilege, but can be carried out remotely by supplying a crafted OCSP response to a vulnerable application. The EPSS score is not published, and the vulnerability is not in the CISA KEV list, indicating no publicly known exploits at this time.