The flaw resides in wolfSSL’s ParseCRL_Extensions routine where critical extensions are not enforced, allowing a crafted CRL that contains an unhandled critical extension to be accepted as valid. The result is that a once‑revoked or forged certificate can bypass revocation checks because the library mistakenly treats the CRL as trustworthy. This vulnerability is categorized as CWE‑295, indicating insecure certificate validation.

All wolfSSL builds that have CRL support enabled are potentially impacted. Any deployment incorporating the wolfSSL library with CRL parsing enabled and without the patch that enforces critical‑extension verification is susceptible. The specific affected versions are those preceding the corrective changes in the library’s source history.

The CVSS score of 1 indicates a low technical impact, and the EPSS score is not available. It is not listed in the CISA KEV catalog, suggesting limited known exploitation. The likely attack vector is inferred: an attacker must provide a malicious CRL that is signed by a trusted authority to a system parsing CRLs, such as during a TLS handshake or when a client fetches a CRL to validate a server’s certificate. Because the prone code only triggers when CRL support is enabled, the likelihood of exploitation is restricted to environments that actively use CRL revocation lists.