Bug#1141816: trixie-pu: package wolfssl/5.7.2-0.1+deb13u2

diff -Nru wolfssl-5.7.2/debian/changelog wolfssl-5.7.2/debian/changelog
--- wolfssl-5.7.2/debian/changelog	2025-08-10 15:17:47.000000000 +0200
+++ wolfssl-5.7.2/debian/changelog	2026-07-05 23:43:31.000000000 +0200
@@ -1,3 +1,30 @@
+wolfssl (5.7.2-0.1+deb13u2) trixie-security; urgency=high
+
+  * Backport upstream security fixes. (See #1140765, #1140815)
+  * CVE-2026-5194: require certificate signature OID to match issuer key
+    OID.
+  * CVE-2026-55960: validate negotiated certificate type for raw public
+    keys.
+  * CVE-2026-55961: reject degenerate certs-only PKCS#7 in PKCS7_verify.
+  * CVE-2026-55962: require client cert on outstanding TLS 1.3 post-
+    handshake auth.
+  * CVE-2026-55967: reject AES-GCM cumulative size overflow in streaming
+    update.
+  * CVE-2026-6092: enforce Encrypt-then-MAC on the TLS resumption path.
+  * CVE-2026-6094: bound encrypted content size in PKCS7 EnvelopedData.
+  * CVE-2026-6325: bound index in SetSuitesHashSigAlgo to prevent OOB
+    write.
+  * CVE-2026-6329: reject PKCS#12 MAC length mismatch.
+  * CVE-2026-6331: require exact HMAC tag length in
+    EVP_DigestVerifyFinal.
+  * CVE-2026-6450: reject CRLs with unrecognized critical extensions.
+  * CVE-2026-6678: fix integer underflow in wc_PKCS7_DecryptOri.
+  * CVE-2026-6681: respect caller output buffer size in PKCS7 decode.
+  * CVE-2026-6731: apply DNS name constraints to Subject CN when no SAN.
+  * CVE-2026-7511: report the verifying cert as the PKCS#7 signer.
+
+ -- Jacob Barthelmeh <[email protected]>  Sun, 05 Jul 2026 15:43:31 -0600
+
 wolfssl (5.7.2-0.1+deb13u1) trixie; urgency=medium
 
   * Fix CVE-2025-7394: weak/predictable random numbers. (Closes: #1109549)
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-5194-digest-sizes.patch wolfssl-5.7.2/debian/patches/CVE-2026-5194-digest-sizes.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-5194-digest-sizes.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-5194-digest-sizes.patch	2026-07-05 23:43:31.000000000 +0200
@@ -0,0 +1,382 @@
+Description: CVE-2026-5194 - enforce minimum/maximum digest sizes in signature ops
+ Companion to CVE-2026-5194.patch (asn.c signature-OID match). Backports the
+ wolfcrypt-level digest-size enforcement half of upstream commit abce5be9: adds
+ WC_MIN_DIGEST_SIZE (hash.h) and rejects too-small/too-large hash inputs in the
+ ECC and DSA sign/verify primitives, the Ed25519ph/Ed448ph prehash length,
+ wc_SignatureVerifyHash and the PKCS7 ECDSA verify path. The upstream internal.c
+ EccVerify guard is omitted: it is redundant (EccVerify calls the now-guarded
+ wc_ecc_verify_hash) and its context mis-binds to Ed25519Sign on 5.7.2. The
+ enum->define header refactor, kernel module port, dilithium (not built) and
+ test-only hunks are likewise omitted.
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/abce5be989ccd0665e2b9445abb856886975dfd1
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-5194
+Author: wolfSSL
+Forwarded: not-needed
+Index: wolfssl-5.7.2/wolfcrypt/src/dsa.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/dsa.c
++++ wolfssl-5.7.2/wolfcrypt/src/dsa.c
+@@ -34,6 +34,7 @@
+ #include <wolfssl/wolfcrypt/logging.h>
+ #include <wolfssl/wolfcrypt/sha.h>
+ #include <wolfssl/wolfcrypt/dsa.h>
++#include <wolfssl/wolfcrypt/hash.h>
+ 
+ #ifdef NO_INLINE
+     #include <wolfssl/wolfcrypt/misc.h>
+@@ -680,6 +681,12 @@ int wc_DsaSign_ex(const byte* digest, wo
+     if (digest == NULL || out == NULL || key == NULL || rng == NULL)
+         return BAD_FUNC_ARG;
+ 
++    if ((digestSz > WC_MAX_DIGEST_SIZE) ||
++        (digestSz < WC_MIN_DIGEST_SIZE))
++    {
++        return BAD_LENGTH_E;
++    }
++
+     SAVE_VECTOR_REGISTERS(return _svr_ret;);
+ 
+     do {
+@@ -1013,6 +1020,16 @@ int wc_DsaVerify_ex(const byte* digest,
+     if (digest == NULL || sig == NULL || key == NULL || answer == NULL)
+         return BAD_FUNC_ARG;
+ 
++    /* Note the min allowed digestSz here is WC_SHA_DIGEST_SIZE, not
++     * WC_MIN_DIGEST_SIZE, to allow verify-only legacy DSA operations, as
++     * expressly allowed under FIPS 186-5, FIPS 140-3, and SP 800-131A.
++     */
++    if ((digestSz > WC_MAX_DIGEST_SIZE) ||
++        (digestSz < WC_SHA_DIGEST_SIZE))
++    {
++        return BAD_LENGTH_E;
++    }
++
+     do {
+ #ifdef WOLFSSL_SMALL_STACK
+         w = (mp_int *)XMALLOC(sizeof *w, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+Index: wolfssl-5.7.2/wolfcrypt/src/ecc.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/ecc.c
++++ wolfssl-5.7.2/wolfcrypt/src/ecc.c
+@@ -6726,6 +6726,11 @@ int wc_ecc_sign_hash(const byte* in, wor
+     if (in == NULL || out == NULL || outlen == NULL || key == NULL) {
+         return ECC_BAD_ARG_E;
+     }
++    if ((inlen > WC_MAX_DIGEST_SIZE) ||
++        (inlen < WC_MIN_DIGEST_SIZE))
++    {
++        return BAD_LENGTH_E;
++    }
+ 
+ #ifdef WOLF_CRYPTO_CB
+     #ifndef WOLF_CRYPTO_CB_FIND
+@@ -7224,6 +7229,11 @@ int wc_ecc_sign_hash_ex(const byte* in,
+    if (in == NULL || r == NULL || s == NULL || key == NULL || rng == NULL) {
+        return ECC_BAD_ARG_E;
+    }
++   if ((inlen > WC_MAX_DIGEST_SIZE) ||
++       (inlen < WC_MIN_DIGEST_SIZE))
++   {
++       return BAD_LENGTH_E;
++   }
+ 
+    /* is this a private key? */
+    if (key->type != ECC_PRIVATEKEY && key->type != ECC_PRIVATEKEY_ONLY) {
+@@ -8466,6 +8476,12 @@ int wc_ecc_verify_hash(const byte* sig,
+         return ECC_BAD_ARG_E;
+     }
+ 
++    /* Check hash length */
++    if ((hashlen > WC_MAX_DIGEST_SIZE) ||
++        (hashlen < WC_MIN_DIGEST_SIZE)) {
++        return BAD_LENGTH_E;
++    }
++
+ #ifdef WOLF_CRYPTO_CB
+     #ifndef WOLF_CRYPTO_CB_FIND
+     if (key->devId != INVALID_DEVID)
+@@ -9073,6 +9089,12 @@ int wc_ecc_verify_hash_ex(mp_int *r, mp_
+    if (r == NULL || s == NULL || hash == NULL || res == NULL || key == NULL)
+        return ECC_BAD_ARG_E;
+ 
++    /* Check hash length */
++    if ((hashlen > WC_MAX_DIGEST_SIZE) ||
++        (hashlen < WC_MIN_DIGEST_SIZE)) {
++        return BAD_LENGTH_E;
++    }
++
+    /* default to invalid signature */
+    *res = 0;
+ 
+Index: wolfssl-5.7.2/wolfcrypt/src/ed25519.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/ed25519.c
++++ wolfssl-5.7.2/wolfcrypt/src/ed25519.c
+@@ -396,6 +396,12 @@ int wc_ed25519_sign_msg_ex(const byte* i
+         return BAD_FUNC_ARG;
+     }
+ 
++    if ((type == Ed25519ph) &&
++        (inLen != WC_SHA512_DIGEST_SIZE))
++    {
++        return BAD_LENGTH_E;
++    }
++
+ #ifdef WOLF_CRYPTO_CB
+     if (key->devId != INVALID_DEVID) {
+         ret = wc_CryptoCb_Ed25519Sign(in, inLen, out, outLen, key, type,
+@@ -854,6 +860,12 @@ int wc_ed25519_verify_msg_ex(const byte*
+                                          (context == NULL && contextLen != 0))
+         return BAD_FUNC_ARG;
+ 
++    if ((type == Ed25519ph) &&
++        (msgLen != WC_SHA512_DIGEST_SIZE))
++    {
++        return BAD_LENGTH_E;
++    }
++
+ #ifdef WOLF_CRYPTO_CB
+     if (key->devId != INVALID_DEVID) {
+         ret = wc_CryptoCb_Ed25519Verify(sig, sigLen, msg, msgLen, res, key,
+Index: wolfssl-5.7.2/wolfcrypt/src/ed448.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/ed448.c
++++ wolfssl-5.7.2/wolfcrypt/src/ed448.c
+@@ -374,6 +374,11 @@ int wc_ed448_sign_msg_ex(const byte* in,
+         ret = BAD_FUNC_ARG;
+     }
+ 
++    if ((ret == 0) && (type == Ed448ph) && (inLen != ED448_PREHASH_SIZE))
++    {
++        ret = BAD_LENGTH_E;
++    }
++
+     /* check and set up out length */
+     if ((ret == 0) && (*outLen < ED448_SIG_SIZE)) {
+         *outLen = ED448_SIG_SIZE;
+@@ -799,6 +804,12 @@ int wc_ed448_verify_msg_ex(const byte* s
+     if (key == NULL)
+         return BAD_FUNC_ARG;
+ 
++    if ((type == Ed448ph) &&
++        (msgLen != ED448_PREHASH_SIZE))
++    {
++        return BAD_LENGTH_E;
++    }
++
+ #ifdef WOLFSSL_ED448_PERSISTENT_SHA
+     sha = &key->sha;
+ #else
+Index: wolfssl-5.7.2/wolfcrypt/src/hash.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/hash.c
++++ wolfssl-5.7.2/wolfcrypt/src/hash.c
+@@ -405,6 +405,12 @@ int wc_HashGetDigestSize(enum wc_HashTyp
+         #endif
+             break;
+         case WC_HASH_TYPE_BLAKE2B:
++        #if defined(HAVE_BLAKE2B)
++            dig_size = BLAKE2B_OUTBYTES;
++        #else
++            dig_size = HASH_TYPE_E;
++        #endif
++            break;
+         case WC_HASH_TYPE_BLAKE2S:
+         #if defined(HAVE_BLAKE2) || defined(HAVE_BLAKE2S)
+             dig_size = BLAKE2S_OUTBYTES;
+@@ -524,6 +530,12 @@ int wc_HashGetBlockSize(enum wc_HashType
+         #endif
+             break;
+         case WC_HASH_TYPE_BLAKE2B:
++        #if defined(HAVE_BLAKE2B)
++            block_size = BLAKE2B_BLOCKBYTES;
++        #else
++            block_size = HASH_TYPE_E;
++        #endif
++            break;
+         case WC_HASH_TYPE_BLAKE2S:
+         #if defined(HAVE_BLAKE2) || defined(HAVE_BLAKE2S)
+             block_size = BLAKE2S_BLOCKBYTES;
+Index: wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/pkcs7.c
++++ wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+@@ -4107,6 +4107,12 @@ static int wc_PKCS7_EcdsaVerify(PKCS7* p
+     if (pkcs7 == NULL || sig == NULL)
+         return BAD_FUNC_ARG;
+ 
++    /* Check hash length */
++    if ((hashSz > WC_MAX_DIGEST_SIZE) ||
++        (hashSz < WC_MIN_DIGEST_SIZE)) {
++        return BAD_LENGTH_E;
++    }
++
+ #ifdef WOLFSSL_SMALL_STACK
+     digest = (byte*)XMALLOC(MAX_PKCS7_DIGEST_SZ, pkcs7->heap,
+                             DYNAMIC_TYPE_TMP_BUFFER);
+Index: wolfssl-5.7.2/wolfcrypt/src/signature.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/signature.c
++++ wolfssl-5.7.2/wolfcrypt/src/signature.c
+@@ -151,6 +151,35 @@ int wc_SignatureVerifyHash(
+         WOLFSSL_MSG("wc_SignatureVerify: Invalid hash type/len");
+         return ret;
+     }
++
++#if !defined(NO_RSA) && !defined(WOLFSSL_RSA_PUBLIC_ONLY)
++    /* For WC_SIGNATURE_TYPE_RSA_W_ENC, we need to extract the actual size of
++     * the ASN.1-encoded hash.
++     */
++    if (sig_type == WC_SIGNATURE_TYPE_RSA_W_ENC) {
++        int hash_dec_len;
++        word32 idx = 0;
++        if (GetSequence(hash_data, &idx, &hash_dec_len, hash_len) < 0)
++            return ASN_PARSE_E;
++        /* skip the AlgorithmIdentifier */
++        if (GetSequence(hash_data, &idx, &hash_dec_len, hash_len) < 0)
++            return ASN_PARSE_E;
++        idx += (word32)hash_dec_len;
++        /* now sitting at the OCTET STRING containing the digest */
++        if (GetOctetString(hash_data, &idx, &hash_dec_len, hash_len) < 0)
++            return ASN_PARSE_E;
++        if (hash_dec_len != ret)
++            return BAD_LENGTH_E;
++    }
++    else
++#endif
++    {
++        if (hash_len != (word32)ret) {
++            WOLFSSL_MSG("wc_SignatureVerify: Invalid hash size");
++            return BAD_LENGTH_E;
++        }
++    }
++
+     ret = 0;
+ 
+     /* Verify signature using hash */
+Index: wolfssl-5.7.2/wolfssl/wolfcrypt/hash.h
+===================================================================
+--- wolfssl-5.7.2.orig/wolfssl/wolfcrypt/hash.h
++++ wolfssl-5.7.2/wolfssl/wolfcrypt/hash.h
+@@ -156,6 +156,87 @@ typedef union {
+     #define WC_MAX_BLOCK_SIZE  128
+ #endif
+ 
++#if defined(WC_HASH_CUSTOM_MAX_DIGEST_SIZE) && \
++    defined(WC_HASH_CUSTOM_MIN_DIGEST_SIZE)
++    #if WC_HASH_CUSTOM_MAX_DIGEST_SIZE < \
++        WC_HASH_CUSTOM_MIN_DIGEST_SIZE
++        #error HASH_CUSTOM_MAX_DIGEST_SIZE < WC_HASH_CUSTOM_MIN_DIGEST_SIZE
++    #endif
++#endif
++#ifdef WC_HASH_CUSTOM_MAX_DIGEST_SIZE
++    #undef WC_MAX_DIGEST_SIZE
++    #define WC_MAX_DIGEST_SIZE WC_HASH_CUSTOM_MAX_DIGEST_SIZE
++#endif
++#ifdef WC_HASH_CUSTOM_MAX_BLOCK_SIZE
++    #undef WC_MAX_BLOCK_SIZE
++    #define WC_MAX_BLOCK_SIZE WC_HASH_CUSTOM_MAX_BLOCK_SIZE
++#endif
++
++/* wolfssl 5.7.2 md2.h/md4.h predate the WC_-prefixed digest-size names used by
++ * the cascade below (they define only MD2_DIGEST_SIZE/MD4_DIGEST_SIZE). Provide
++ * the WC_-prefixed aliases so the upstream enforcement compiles unchanged. */
++#if defined(WOLFSSL_MD2) && !defined(WC_MD2_DIGEST_SIZE)
++    #define WC_MD2_DIGEST_SIZE 16
++#endif
++#if !defined(NO_MD4) && !defined(WC_MD4_DIGEST_SIZE)
++    #define WC_MD4_DIGEST_SIZE 16
++#endif
++#if defined(WC_HASH_CUSTOM_MIN_DIGEST_SIZE)
++    #if defined(WC_FIPS_186_5_PLUS) && \
++            (WC_HASH_CUSTOM_MIN_DIGEST_SIZE < 224 / 8)
++        #error FIPS 186-5 requires a minimum hash size >= SHA-224.
++    #elif defined(WC_FIPS_186_4) && \
++            (WC_HASH_CUSTOM_MIN_DIGEST_SIZE < 160 / 8)
++        #error FIPS 186-4 requires a minimum hash size >= SHA-1.
++    #elif (WC_HASH_CUSTOM_MIN_DIGEST_SIZE < 128 / 8)
++        #error WC_HASH_CUSTOM_MIN_DIGEST_SIZE is too small.
++    #endif
++    /* Let the user override the minimum digest size */
++    #define WC_MIN_DIGEST_SIZE WC_HASH_CUSTOM_MIN_DIGEST_SIZE
++#elif defined(WOLFSSL_MD2) && !defined(WC_FIPS_186_4_PLUS)
++    #define WC_MIN_DIGEST_SIZE WC_MD2_DIGEST_SIZE /* 16 */
++#elif !defined(NO_MD4) && !defined(WC_FIPS_186_4_PLUS)
++    #define WC_MIN_DIGEST_SIZE WC_MD4_DIGEST_SIZE /* 16 */
++#elif !defined(NO_MD5) && !defined(WC_FIPS_186_4_PLUS)
++    #define WC_MIN_DIGEST_SIZE WC_MD5_DIGEST_SIZE /* 16 */
++#elif !defined(NO_SHA) && !defined(WC_FIPS_186_5_PLUS)
++    #define WC_MIN_DIGEST_SIZE WC_SHA_DIGEST_SIZE /* 20 */
++#elif defined(WOLFSSL_SHA224)
++    #define WC_MIN_DIGEST_SIZE WC_SHA224_DIGEST_SIZE
++#elif !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) && \
++    defined(WOLFSSL_SHA512) && !defined(WOLFSSL_NOSHA512_224)
++    #define WC_MIN_DIGEST_SIZE WC_SHA512_224_DIGEST_SIZE
++#elif defined(WOLFSSL_SHA3) && !defined(WOLFSSL_NOSHA3_224)
++    #define WC_MIN_DIGEST_SIZE WC_SHA3_224_DIGEST_SIZE
++#elif !defined(NO_SHA256)
++    #define WC_MIN_DIGEST_SIZE WC_SHA256_DIGEST_SIZE
++#elif !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) && \
++    defined(WOLFSSL_SHA512) && !defined(WOLFSSL_NOSHA512_256)
++    #define WC_MIN_DIGEST_SIZE WC_SHA512_256_DIGEST_SIZE
++#elif defined(WOLFSSL_SHA3) && !defined(WOLFSSL_NOSHA3_256)
++    #define WC_MIN_DIGEST_SIZE WC_SHA3_256_DIGEST_SIZE
++#elif defined(HAVE_BLAKE2S)
++    #define WC_MIN_DIGEST_SIZE BLAKE2S_OUTBYTES /* 32 */
++#elif defined(WOLFSSL_SM3)
++    #define WC_MIN_DIGEST_SIZE WC_SM3_DIGEST_SIZE /* 32 */
++#elif defined(WOLFSSL_SHA384)
++    #define WC_MIN_DIGEST_SIZE WC_SHA384_DIGEST_SIZE
++#elif defined(WOLFSSL_SHA3) && !defined(WOLFSSL_NOSHA3_384)
++    #define WC_MIN_DIGEST_SIZE WC_SHA3_384_DIGEST_SIZE
++#elif defined(WOLFSSL_SHA512)
++    #define WC_MIN_DIGEST_SIZE WC_SHA512_DIGEST_SIZE
++#elif defined(WOLFSSL_SHA3) && !defined(WOLFSSL_NOSHA3_512)
++    #define WC_MIN_DIGEST_SIZE WC_SHA3_512_DIGEST_SIZE
++#elif defined(HAVE_BLAKE2B)
++    #define WC_MIN_DIGEST_SIZE BLAKE2B_OUTBYTES /* 64 */
++#elif defined(WOLFSSL_SHAKE128) || defined(WOLFSSL_SHAKE256)
++    #error SHAKE enabled without SHA-3.
++    #define WC_MIN_DIGEST_SIZE 64
++#else
++    #error No builtin hashes enabled and no WC_HASH_CUSTOM_MIN_DIGEST_SIZE.
++    #define WC_MIN_DIGEST_SIZE 64
++#endif
++
+ #if !defined(NO_ASN) || !defined(NO_DH) || defined(HAVE_ECC)
+ WOLFSSL_API int wc_HashGetOID(enum wc_HashType hash_type);
+ WOLFSSL_API enum wc_HashType wc_OidGetHash(int oid);
+Index: wolfssl-5.7.2/wolfssl/wolfcrypt/settings.h
+===================================================================
+--- wolfssl-5.7.2.orig/wolfssl/wolfcrypt/settings.h
++++ wolfssl-5.7.2/wolfssl/wolfcrypt/settings.h
+@@ -460,6 +460,29 @@
+     #define SIZEOF_LONG_LONG 8
+ #endif
+ 
++#if defined(HAVE_FIPS) && !defined(WC_FIPS_186_5) && !defined(WC_FIPS_186_4)
++    #if FIPS_VERSION3_GE(7,0,0)
++        #ifndef WC_FIPS_186_5
++            #define WC_FIPS_186_5
++        #endif
++    #else
++        #ifndef WC_FIPS_186_4
++            #define WC_FIPS_186_4
++        #endif
++    #endif
++#endif
++#if defined(WC_FIPS_186_4) && defined(WC_FIPS_186_5)
++    #error Conflicting FIPS 186 settings.
++#endif
++#if (defined(WC_FIPS_186_4) || defined(WC_FIPS_186_5)) && \
++        !defined(WC_FIPS_186_4_PLUS)
++    #define WC_FIPS_186_4_PLUS
++#endif
++#if defined(WC_FIPS_186_5) && !defined(WC_FIPS_186_5_PLUS)
++    #define WC_FIPS_186_5_PLUS
++#endif
++
++
+ #ifdef HAVE_NETX
+     #ifdef NEED_THREADX_TYPES
+         #include <types.h>
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-5194.patch wolfssl-5.7.2/debian/patches/CVE-2026-5194.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-5194.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-5194.patch	2026-07-05 23:33:37.000000000 +0200
@@ -0,0 +1,142 @@
+Description: CVE-2026-5194 - require certificate signature OID to match issuer key OID
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/abce5be989ccd0665e2b9445abb856886975dfd1
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-5194
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/asn.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/asn.c
++++ wolfssl-5.7.2/wolfcrypt/src/asn.c
+@@ -16545,6 +16545,118 @@ static int HashForSignature(const byte*
+ }
+ #endif /* !NO_ASN_CRYPT && !NO_HASH_WRAPPER */
+ 
++/* The certificate's signatureAlgorithm (sigOID) must match the issuer's
++ * key type (keyOID). sigOID picks the pre-hash; keyOID picks the
++ * verifier. They need to agree or the verifier gets the wrong input. */
++static int SigOidMatchesKeyOid(word32 sigOID, word32 keyOID)
++{
++    switch (keyOID) {
++    #ifndef NO_RSA
++        case RSAk:
++            switch (sigOID) {
++                case CTC_MD2wRSA:
++                case CTC_MD5wRSA:
++                case CTC_SHAwRSA:
++                case CTC_SHA224wRSA:
++                case CTC_SHA256wRSA:
++                case CTC_SHA384wRSA:
++                case CTC_SHA512wRSA:
++                case CTC_SHA3_224wRSA:
++                case CTC_SHA3_256wRSA:
++                case CTC_SHA3_384wRSA:
++                case CTC_SHA3_512wRSA:
++                case CTC_RSASSAPSS:
++                    return 1;
++            }
++            return 0;
++        #ifdef WC_RSA_PSS
++        case RSAPSSk:
++            return (sigOID == CTC_RSASSAPSS);
++        #endif
++    #endif
++    #if !defined(NO_DSA) && !defined(HAVE_SELFTEST)
++        case DSAk:
++            switch (sigOID) {
++                case CTC_SHAwDSA:
++                case CTC_SHA256wDSA:
++                    return 1;
++            }
++            return 0;
++    #endif
++    #if defined(HAVE_ECC) && defined(HAVE_ECC_VERIFY)
++        case ECDSAk:
++        #if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3)
++        case SM2k:
++        #endif
++            switch (sigOID) {
++                case CTC_SHAwECDSA:
++                case CTC_SHA224wECDSA:
++                case CTC_SHA256wECDSA:
++                case CTC_SHA384wECDSA:
++                case CTC_SHA512wECDSA:
++                case CTC_SHA3_224wECDSA:
++                case CTC_SHA3_256wECDSA:
++                case CTC_SHA3_384wECDSA:
++                case CTC_SHA3_512wECDSA:
++            #if defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3)
++                case CTC_SM3wSM2:
++            #endif
++                    return 1;
++            }
++            return 0;
++    #endif
++    #if defined(HAVE_ED25519) && defined(HAVE_ED25519_KEY_IMPORT)
++        case ED25519k:
++            return (sigOID == CTC_ED25519);
++    #endif
++    #if defined(HAVE_ED448) && defined(HAVE_ED448_KEY_IMPORT)
++        case ED448k:
++            return (sigOID == CTC_ED448);
++    #endif
++    #if defined(HAVE_FALCON)
++        case FALCON_LEVEL1k:
++            return (sigOID == CTC_FALCON_LEVEL1);
++        case FALCON_LEVEL5k:
++            return (sigOID == CTC_FALCON_LEVEL5);
++    #endif
++    #if defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_VERIFY) && \
++        !defined(WOLFSSL_DILITHIUM_NO_ASN1)
++        #ifdef WOLFSSL_DILITHIUM_FIPS204_DRAFT
++        case DILITHIUM_LEVEL2k:
++            return (sigOID == CTC_DILITHIUM_LEVEL2);
++        case DILITHIUM_LEVEL3k:
++            return (sigOID == CTC_DILITHIUM_LEVEL3);
++        case DILITHIUM_LEVEL5k:
++            return (sigOID == CTC_DILITHIUM_LEVEL5);
++        #endif
++        case ML_DSA_LEVEL2k:
++            return (sigOID == CTC_ML_DSA_LEVEL2);
++        case ML_DSA_LEVEL3k:
++            return (sigOID == CTC_ML_DSA_LEVEL3);
++        case ML_DSA_LEVEL5k:
++            return (sigOID == CTC_ML_DSA_LEVEL5);
++    #endif
++    #if defined(HAVE_SPHINCS)
++        case SPHINCS_FAST_LEVEL1k:
++            return (sigOID == CTC_SPHINCS_FAST_LEVEL1);
++        case SPHINCS_FAST_LEVEL3k:
++            return (sigOID == CTC_SPHINCS_FAST_LEVEL3);
++        case SPHINCS_FAST_LEVEL5k:
++            return (sigOID == CTC_SPHINCS_FAST_LEVEL5);
++        case SPHINCS_SMALL_LEVEL1k:
++            return (sigOID == CTC_SPHINCS_SMALL_LEVEL1);
++        case SPHINCS_SMALL_LEVEL3k:
++            return (sigOID == CTC_SPHINCS_SMALL_LEVEL3);
++        case SPHINCS_SMALL_LEVEL5k:
++            return (sigOID == CTC_SPHINCS_SMALL_LEVEL5);
++    #endif
++    }
++
++    /* Default to reject unknown key types */
++    (void)sigOID;
++    return 0;
++}
++
+ /* Return codes: 0=Success, Negative (see error-crypt.h), ASN_SIG_CONFIRM_E */
+ static int ConfirmSignature(SignatureCtx* sigCtx,
+     const byte* buf, word32 bufSz,
+@@ -16610,6 +16722,11 @@ static int ConfirmSignature(SignatureCtx
+ 
+         case SIG_STATE_HASH:
+         {
++            if (!SigOidMatchesKeyOid(sigOID, keyOID)) {
++                WOLFSSL_MSG("sigOID incompatible with issuer keyOID");
++                ERROR_OUT(ASN_SIG_OID_E, exit_cs);
++            }
++
+         #if !defined(NO_RSA) && defined(WC_RSA_PSS)
+             if (sigOID == RSAPSSk) {
+                 word32 fakeSigOID = 0;
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-55960.patch wolfssl-5.7.2/debian/patches/CVE-2026-55960.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-55960.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-55960.patch	2026-07-05 23:40:41.000000000 +0200
@@ -0,0 +1,61 @@
+Description: CVE-2026-55960 - validate negotiated certificate type for raw public keys
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/c929798460656431bdeeffbf701a74521f403f36
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-55960
+Author: wolfSSL
+Forwarded: not-needed
+---
+Index: wolfssl-5.7.2/src/internal.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/internal.c
++++ wolfssl-5.7.2/src/internal.c
+@@ -14146,31 +14146,29 @@ PRAGMA_GCC_DIAG_POP
+     ret = ParseCertRelative(args->dCert, certType, verify, SSL_CM(ssl), extraSigners);
+ 
+ #if defined(HAVE_RPK)
+-    /* if cert type has negotiated with peer, confirm the cert received has
+-     * the same type.
+-     */
+-    if (ret == 0 ) {
+-        if (ssl->options.side ==  WOLFSSL_CLIENT_END) {
+-            if (ssl->options.rpkState.received_ServerCertTypeCnt == 1) {
++    /* Confirm the received certificate's form (X.509 vs raw public key) matches
++     * the type negotiated with the peer. A raw public key (RFC 7250) has no
++     * chain, so ParseCertRelative() accepts it without any trust verification;
++     * it must only be accepted when RPK was negotiated for this peer. When no
++     * type was negotiated the default is X.509 (RFC 7250/8446), so an
++     * un-negotiated bare key is rejected. The negotiated type is the received
++     * server cert type (client) or the selected client cert type (server). */
++    if (ret == 0) {
++        cType = WOLFSSL_CERT_TYPE_X509;
++        if (ssl->options.side == WOLFSSL_CLIENT_END) {
++            if (ssl->options.rpkState.received_ServerCertTypeCnt == 1)
+                 cType = ssl->options.rpkState.received_ServerCertTypes[0];
+-                if ((cType == WOLFSSL_CERT_TYPE_RPK && !args->dCert->isRPK) ||
+-                    (cType == WOLFSSL_CERT_TYPE_X509 && args->dCert->isRPK)) {
+-                    /* cert type mismatch */
+-                    WOLFSSL_MSG("unsupported certificate type received");
+-                    ret = UNSUPPORTED_CERTIFICATE;
+-                }
+-            }
+         }
+         else if (ssl->options.side == WOLFSSL_SERVER_END) {
+-            if (ssl->options.rpkState.received_ClientCertTypeCnt == 1) {
++            if (ssl->options.rpkState.sending_ClientCertTypeCnt == 1)
+                 cType = ssl->options.rpkState.sending_ClientCertTypes[0];
+-                if ((cType == WOLFSSL_CERT_TYPE_RPK && !args->dCert->isRPK) ||
+-                    (cType == WOLFSSL_CERT_TYPE_X509 && args->dCert->isRPK)) {
+-                    /* cert type mismatch */
+-                    WOLFSSL_MSG("unsupported certificate type received");
+-                    ret = UNSUPPORTED_CERTIFICATE;
+-                }
+-            }
++        }
++
++        if ((cType == WOLFSSL_CERT_TYPE_RPK && !args->dCert->isRPK) ||
++            (cType != WOLFSSL_CERT_TYPE_RPK && args->dCert->isRPK)) {
++            /* cert type mismatch - includes an un-negotiated raw public key */
++            WOLFSSL_MSG("unsupported certificate type received");
++            ret = UNSUPPORTED_CERTIFICATE;
+         }
+     }
+ #endif /* HAVE_RPK */
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-55961.patch wolfssl-5.7.2/debian/patches/CVE-2026-55961.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-55961.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-55961.patch	2026-07-05 23:37:14.000000000 +0200
@@ -0,0 +1,31 @@
+Description: CVE-2026-55961 - reject degenerate certs-only PKCS#7 in wolfSSL_PKCS7_verify
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/d382439c7c63c07294cf4fcece0aa56a35399d15
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-55961
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/src/ssl_p7p12.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/ssl_p7p12.c
++++ wolfssl-5.7.2/src/ssl_p7p12.c
+@@ -806,6 +806,19 @@ int wolfSSL_PKCS7_verify(PKCS7* pkcs7, W
+     if (ret != 0)
+         return WOLFSSL_FAILURE;
+ 
++    /* Reject a degenerate (certs-only) PKCS#7 with no verified signer. Such an
++     * object has empty signerInfos, so wc_PKCS7_VerifySignedData() succeeds
++     * without authenticating the content. pkcs7.verifyCert is only set once a
++     * signer's signature has actually been verified, so a NULL value here means
++     * the content carries no valid signature and must not be reported as
++     * verified - regardless of PKCS7_NOVERIFY, which only suppresses signer
++     * certificate chain validation, not the requirement that a signature exist.
++     */
++    if (p7->pkcs7.verifyCert == NULL) {
++        WOLFSSL_MSG("PKCS7 has no verified signer (degenerate/certs-only)");
++        return WOLFSSL_FAILURE;
++    }
++
+     if ((flags & PKCS7_NOVERIFY) != PKCS7_NOVERIFY) {
+         /* Verify signer certificates */
+         if (store == NULL || store->cm == NULL) {
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-55962.patch wolfssl-5.7.2/debian/patches/CVE-2026-55962.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-55962.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-55962.patch	2026-07-05 23:33:37.000000000 +0200
@@ -0,0 +1,44 @@
+Description: CVE-2026-55962 - require client cert on outstanding TLS1.3 post-handshake auth
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/f23544f09476d420becdfabd781eec0dd1a9c597
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-55962
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/src/tls13.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/tls13.c
++++ wolfssl-5.7.2/src/tls13.c
+@@ -10649,7 +10649,10 @@ int DoTls13Finished(WOLFSSL* ssl, const
+ #endif
+         if (
+         #ifdef WOLFSSL_POST_HANDSHAKE_AUTH
+-            !ssl->options.verifyPostHandshake &&
++            /* Exempt only the initial handshake; a pending post-handshake
++             * CertificateRequest (certReqCtx != NULL) still requires a peer
++             * certificate and a valid CertificateVerify. */
++            (!ssl->options.verifyPostHandshake || ssl->certReqCtx != NULL) &&
+         #endif
+             (!ssl->options.havePeerCert || !ssl->options.havePeerVerify)) {
+             ret = NO_PEER_CERT; /* NO_PEER_VERIFY */
+@@ -12228,7 +12231,19 @@ static int SanityCheckTls13MsgReceived(W
+                  */
+                 if (ssl->options.verifyPeer &&
+                 #ifdef WOLFSSL_POST_HANDSHAKE_AUTH
+-                    !ssl->options.verifyPostHandshake &&
++                    /* The post-handshake-auth exemption is only valid during
++                     * the initial handshake. On the server, once a
++                     * post-handshake CertificateRequest is outstanding
++                     * (certReqCtx != NULL), a Certificate is required again.
++                     * Scoped to the server: certReqCtx means something
++                     * different on the client (a received request) and the
++                     * client does not process an inbound Finished in that
++                     * state. Whether an empty Certificate is then accepted
++                     * follows the verify mode (FAIL_IF_NO_PEER_CERT), exactly
++                     * as for first-handshake client authentication. */
++                    (!ssl->options.verifyPostHandshake ||
++                     (ssl->options.side == WOLFSSL_SERVER_END &&
++                      ssl->certReqCtx != NULL)) &&
+                 #endif
+                                            !ssl->msgsReceived.got_certificate) {
+                     WOLFSSL_MSG("Finished received out of order - "
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-55967.patch wolfssl-5.7.2/debian/patches/CVE-2026-55967.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-55967.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-55967.patch	2026-07-05 23:33:37.000000000 +0200
@@ -0,0 +1,49 @@
+Description: CVE-2026-55967 - reject AES-GCM cumulative size overflow in streaming update
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/5def276e07e23b7b3b5842afbe526b4d3703ce13
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-55967
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/aes.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/aes.c
++++ wolfssl-5.7.2/wolfcrypt/src/aes.c
+@@ -10001,6 +10001,18 @@ int wc_AesGcmEncryptUpdate(Aes* aes, byt
+         ret = MISSING_IV;
+     }
+ 
++    /* Prevent overflow of aes->cSz and ->aSz.  Per NIST SP 800-38D section
++     * 5.2.1.1, the maximum allowed ciphertext limit is 2^32 - 2 blocks, but we
++     * currently pass around the cunulative sizes in bytes as word32s, so we
++     * can't currently support the maximum allowed.
++     */
++    if ((ret == 0) &&
++        (((aes->cSz > 0xffffffff - sz)) ||
++         ((aes->aSz > 0xffffffff - authInSz))))
++    {
++        ret = AES_GCM_OVERFLOW_E;
++    }
++
+     if ((ret == 0) && aes->ctrSet && (aes->aSz == 0) && (aes->cSz == 0)) {
+         aes->invokeCtr[0]++;
+         if (aes->invokeCtr[0] == 0) {
+@@ -10147,6 +10159,18 @@ int wc_AesGcmDecryptUpdate(Aes* aes, byt
+         ret = MISSING_IV;
+     }
+ 
++    /* Prevent overflow of aes->cSz and ->aSz.  Per NIST SP 800-38D section
++     * 5.2.1.1, the maximum allowed ciphertext limit is 2^32 - 2 blocks, but we
++     * currently pass around the cunulative sizes in bytes as word32s, so we
++     * can't currently support the maximum allowed.
++     */
++    if ((ret == 0) &&
++        (((aes->cSz > 0xffffffff - sz)) ||
++         ((aes->aSz > 0xffffffff - authInSz))))
++    {
++        ret = AES_GCM_OVERFLOW_E;
++    }
++
+     if (ret == 0) {
+         /* Decrypt with AAD and/or cipher text. */
+     #ifdef WOLFSSL_AESNI
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6092.patch wolfssl-5.7.2/debian/patches/CVE-2026-6092.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6092.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6092.patch	2026-07-05 23:33:37.000000000 +0200
@@ -0,0 +1,39 @@
+Description: CVE-2026-6092 - enforce Encrypt-then-MAC on TLS resumption path
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/af5369636a938faf4a79d1f550d3b206c51fafec
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6092
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/src/internal.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/internal.c
++++ wolfssl-5.7.2/src/internal.c
+@@ -37052,13 +37052,21 @@ static int DoSessionTicket(WOLFSSL* ssl,
+ 
+ #if defined(HAVE_TLS_EXTENSIONS) && defined(HAVE_ENCRYPT_THEN_MAC) && \
+     !defined(WOLFSSL_AEAD_ONLY)
+-            if (ssl->options.encThenMac && ssl->specs.cipher_type == block) {
+-                ret = TLSX_EncryptThenMac_Respond(ssl);
+-                if (ret != 0)
+-                    goto out;
++            /* Only respond to ETM here when resumption actually succeeded;
++             * HandleTlsResumption populates ssl->specs via SetCipherSpecs only
++             * on the success path. If resumption failed, resuming has been
++             * cleared and ssl->specs.cipher_type is still zero-initialized,
++             * so we must defer the ETM decision until after MatchSuite. */
++            if (ssl->options.resuming) {
++                if (ssl->options.encThenMac &&
++                                          ssl->specs.cipher_type == block) {
++                    ret = TLSX_EncryptThenMac_Respond(ssl);
++                    if (ret != 0)
++                        goto out;
++                }
++                else
++                    ssl->options.encThenMac = 0;
+             }
+-            else
+-                ssl->options.encThenMac = 0;
+ #endif
+             if (ssl->options.clientState == CLIENT_KEYEXCHANGE_COMPLETE) {
+                 WOLFSSL_LEAVE("DoClientHello", ret);
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6094.patch wolfssl-5.7.2/debian/patches/CVE-2026-6094.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6094.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6094.patch	2026-07-05 23:33:37.000000000 +0200
@@ -0,0 +1,23 @@
+Description: CVE-2026-6094 - bound encrypted content size in PKCS7 EnvelopedData
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/1397268aa12e2cf3f80c3acfa9b6036b809c08ef
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6094
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/pkcs7.c
++++ wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+@@ -12393,6 +12393,11 @@ WOLFSSL_API int wc_PKCS7_DecodeEnveloped
+                 }
+ 
+             } else {
++                if ((idx + (word32)encryptedContentTotalSz) > pkiMsgSz) {
++                    ret = BUFFER_E;
++                    break;
++                }
++
+                 /* cache encrypted content, no OCTET STRING */
+                 ret = PKCS7_CacheEncryptedContent(pkcs7, &pkiMsg[idx],
+                                                   (word32)encryptedContentTotalSz);
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6325.patch wolfssl-5.7.2/debian/patches/CVE-2026-6325.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6325.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6325.patch	2026-07-05 23:34:07.000000000 +0200
@@ -0,0 +1,28 @@
+Description: CVE-2026-6325 - bound index in SetSuitesHashSigAlgo to prevent OOB write
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/f540bb3ddfef89db637809392522247ce3e8200c
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6325
+Author: wolfSSL
+Forwarded: not-needed
+---
+Index: wolfssl-5.7.2/src/internal.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/internal.c
++++ wolfssl-5.7.2/src/internal.c
+@@ -27378,6 +27378,17 @@ int SetSuitesHashSigAlgo(Suites* suites,
+                     break;
+                 }
+             }
++            {
++                word32 needed = 2;
++#if defined(WC_RSA_PSS) && defined(WOLFSSL_TLS13)
++                if (sig_alg == rsa_pss_sa_algo)
++                    needed = 4;
++#endif
++                if ((word32)idx + needed > WOLFSSL_MAX_SIGALGO) {
++                    ret = 0;
++                    break;
++                }
++            }
+             AddSuiteHashSigAlgo(suites->hashSigAlgo, mac_alg, sig_alg, 0, &idx);
+             sig_alg = 0;
+             mac_alg = no_mac;
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6329.patch wolfssl-5.7.2/debian/patches/CVE-2026-6329.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6329.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6329.patch	2026-07-05 23:33:37.000000000 +0200
@@ -0,0 +1,24 @@
+Description: CVE-2026-6329 - reject PKCS#12 MAC length mismatch
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/9c304bdc099140ad2fdc41ef2f2602af9768c8a1
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6329
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/pkcs12.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/pkcs12.c
++++ wolfssl-5.7.2/wolfcrypt/src/pkcs12.c
+@@ -652,6 +652,12 @@ static int wc_PKCS12_verify(WC_PKCS12* p
+         return ret;
+     }
+ 
++    if ((word32)ret != mac->digestSz) {
++        WOLFSSL_MSG("PKCS12 MAC digest size mismatch");
++        ForceZero(digest, sizeof(digest));
++        return MAC_CMP_FAILED_E;
++    }
++
+ #ifdef WOLFSSL_DEBUG_PKCS12
+     {
+         byte* p;
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6331.patch wolfssl-5.7.2/debian/patches/CVE-2026-6331.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6331.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6331.patch	2026-07-05 23:33:38.000000000 +0200
@@ -0,0 +1,26 @@
+Description: CVE-2026-6331 - require exact HMAC tag length in EVP_DigestVerifyFinal
+ A zero-length or truncated tag passed to wolfSSL_EVP_DigestVerifyFinal() was
+ accepted, because the length check only rejected oversized tags and an
+ XMEMCMP() of length zero returns a match. Require the supplied tag length to
+ equal the MAC length exactly.
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/0749f20c33516897d8c5e2ab083b855e2d17d665
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6331
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/evp.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/evp.c
++++ wolfssl-5.7.2/wolfcrypt/src/evp.c
+@@ -4636,9 +4636,8 @@ int wolfSSL_EVP_DigestVerifyFinal(WOLFSS
+ 
+         hashLen = wolfssl_mac_len(ctx->hash.hmac.macType);
+ 
+-        if (siglen > hashLen)
++        if (hashLen == 0 || siglen != hashLen)
+             return WOLFSSL_FAILURE;
+-        /* May be a truncated signature. */
+     }
+ 
+     if (wolfssl_evp_digest_pk_final(ctx, digest, &hashLen) <= 0)
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6450.patch wolfssl-5.7.2/debian/patches/CVE-2026-6450.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6450.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6450.patch	2026-07-05 23:39:35.000000000 +0200
@@ -0,0 +1,29 @@
+Description: CVE-2026-6450 - reject CRLs with unrecognized critical extensions
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/857141da35b67a14a580fb26ec57af1efa68a1d9
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6450
+Author: wolfSSL
+Forwarded: not-needed
+Index: wolfssl-5.7.2/wolfcrypt/src/asn.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/asn.c
++++ wolfssl-5.7.2/wolfcrypt/src/asn.c
+@@ -38426,14 +38426,17 @@ static int ParseCRL_Extensions(DecodedCR
+                 }
+             #endif
+             }
++            else if (critical) {
++                WOLFSSL_MSG("Unknown critical CRL extension");
++                ret = ASN_CRIT_EXT_E;
++            }
+             /* TODO: Parse CRL Number extension */
+-            /* TODO: check criticality */
+             /* Move index on to next extension. */
+             idx += (word32)length;
+         }
+     }
+ 
+-    if (ret < 0) {
++    if (ret < 0 && ret != ASN_CRIT_EXT_E) {
+         ret = ASN_PARSE_E;
+     }
+ 
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6678.patch wolfssl-5.7.2/debian/patches/CVE-2026-6678.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6678.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6678.patch	2026-07-05 23:33:38.000000000 +0200
@@ -0,0 +1,34 @@
+Description: CVE-2026-6678 - fix integer underflow in wc_PKCS7_DecryptOri
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/84fb0f694cfaac4187c0beba4298a4a8a7995235
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6678
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/pkcs7.c
++++ wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+@@ -10861,9 +10861,21 @@ static int wc_PKCS7_DecryptOri(PKCS7* pk
+             XMEMCPY(oriOID, pkiMsg + *idx, oriOIDSz);
+             *idx += oriOIDSz;
+ 
++            /* Validate OID did not consume more than the SEQUENCE declared */
++            if ((*idx - tmpIdx) > (word32)seqSz) {
++                WOLFSSL_MSG("ORI oriType OID exceeds SEQUENCE boundary");
++                return ASN_PARSE_E;
++            }
++
+             /* get oriValue, increment idx */
+             oriValue = pkiMsg + *idx;
+-            oriValueSz = seqSz - (*idx - tmpIdx);
++            oriValueSz = (word32)seqSz - (*idx - tmpIdx);
++
++            /* Validate oriValue region is within input buffer */
++            if (*idx > pkiMsgSz || oriValueSz > pkiMsgSz - *idx) {
++                WOLFSSL_MSG("ORI oriValue exceeds input buffer");
++                return ASN_PARSE_E;
++            }
+             *idx += oriValueSz;
+ 
+             /* pass oriOID and oriValue to user callback, expect back
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6681.patch wolfssl-5.7.2/debian/patches/CVE-2026-6681.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6681.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6681.patch	2026-07-05 23:33:38.000000000 +0200
@@ -0,0 +1,34 @@
+Description: CVE-2026-6681 - respect caller output buffer size in PKCS7 decode
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/1de4020fe4f3f911641ac0477227249d4dda2157
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6681
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/pkcs7.c
++++ wolfssl-5.7.2/wolfcrypt/src/pkcs7.c
+@@ -13632,6 +13632,10 @@ authenv_atrbend:
+             }
+ 
+             /* copy plaintext to output */
++            if ((word32)encryptedContentSz > outputSz) {
++                ret = BUFFER_E;
++                break;
++            }
+             XMEMCPY(output, encryptedContent, encryptedContentSz);
+ 
+             /* free memory, zero out keys */
+@@ -14284,6 +14288,11 @@ int wc_PKCS7_DecodeEncryptedData(PKCS7*
+                 }
+ 
+                 /* copy plaintext to output */
++                if ((word32)(encryptedContentSz - padLen) > outputSz) {
++                    XFREE(encryptedContent, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
++                    ret = BUFFER_E;
++                    break;
++                }
+                 XMEMCPY(output, encryptedContent, encryptedContentSz - padLen);
+ 
+                 /* get implicit[1] unprotected attributes, optional */
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-6731.patch wolfssl-5.7.2/debian/patches/CVE-2026-6731.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-6731.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-6731.patch	2026-07-05 23:33:38.000000000 +0200
@@ -0,0 +1,30 @@
+Description: CVE-2026-6731 - apply DNS name constraints to Subject CN when no SAN
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/e7b7fddacb4cc794e5dfc7693586d87a539f5aad
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-6731
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/wolfcrypt/src/asn.c
+===================================================================
+--- wolfssl-5.7.2.orig/wolfcrypt/src/asn.c
++++ wolfssl-5.7.2/wolfcrypt/src/asn.c
+@@ -18017,9 +18017,16 @@ static int ConfirmNameConstraints(Signer
+         XMEMSET(&subjectDnsName, 0, sizeof(DNS_entry));
+         switch (nameType) {
+             case ASN_DNS_TYPE:
+-                /* Should it also consider CN in subject? It could use
+-                 * subjectDnsName too */
+                 name = cert->altNames;
++
++                /* When no SAN is present, apply DNS name constraints to the
++                 * Subject CN. */
++                if (cert->subjectCN != NULL && cert->altNames == NULL) {
++                    subjectDnsName.next = NULL;
++                    subjectDnsName.type = ASN_DNS_TYPE;
++                    subjectDnsName.len  = cert->subjectCNLen;
++                    subjectDnsName.name = cert->subjectCN;
++                }
+                 break;
+             case ASN_RFC822_TYPE:
+                 /* Shouldn't it validate E= in subject as well? */
diff -Nru wolfssl-5.7.2/debian/patches/CVE-2026-7511.patch wolfssl-5.7.2/debian/patches/CVE-2026-7511.patch
--- wolfssl-5.7.2/debian/patches/CVE-2026-7511.patch	1970-01-01 01:00:00.000000000 +0100
+++ wolfssl-5.7.2/debian/patches/CVE-2026-7511.patch	2026-07-05 23:37:14.000000000 +0200
@@ -0,0 +1,59 @@
+Description: CVE-2026-7511 - report the verifying cert as the PKCS#7 signer
+Origin: upstream, https://github.com/wolfSSL/wolfssl/commit/b7f6e77a95bfeda306b22dd34394e49c0a6c8a8c
+Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-7511
+Forwarded: not-needed
+Author: wolfSSL
+Last-Update: 2026-06-29
+
+Index: wolfssl-5.7.2/src/ssl_p7p12.c
+===================================================================
+--- wolfssl-5.7.2.orig/src/ssl_p7p12.c
++++ wolfssl-5.7.2/src/ssl_p7p12.c
+@@ -273,24 +273,42 @@ WOLFSSL_STACK* wolfSSL_PKCS7_get0_signer
+     WOLFSSL_X509* x509 = NULL;
+     WOLFSSL_STACK* signers = NULL;
+     WOLFSSL_PKCS7* p7 = (WOLFSSL_PKCS7*)pkcs7;
++    byte* signerCert;
++    word32 signerCertSz;
+ 
+     if (p7 == NULL)
+         return NULL;
+ 
+-    /* Only PKCS#7 messages with a single cert that is the verifying certificate
+-     * is supported.
+-     */
+     if (flags & PKCS7_NOINTERN) {
+         WOLFSSL_MSG("PKCS7_NOINTERN flag not supported");
+         return NULL;
+     }
+ 
++    /* Prefer the certificate that actually verified the signature. Falling
++     * back to singleCert (cert[0]) would let an attacker that bundles a
++     * trusted cert ahead of their own attacker cert have the trusted cert
++     * reported as the signer even though it did not produce the signature.
++     *
++     * Copy the chosen pointer into a local before passing its address to
++     * wolfSSL_d2i_X509; d2i_X509 advances *in by the DER length, and if
++     * we handed it the address of the struct field directly it would
++     * permanently corrupt the field, producing a heap-OOB read on the
++     * next use (pointer advanced, singleCertSz unchanged). */
++    if (p7->pkcs7.verifyCert != NULL && p7->pkcs7.verifyCertSz > 0) {
++        signerCert   = p7->pkcs7.verifyCert;
++        signerCertSz = p7->pkcs7.verifyCertSz;
++    }
++    else {
++        signerCert   = p7->pkcs7.singleCert;
++        signerCertSz = p7->pkcs7.singleCertSz;
++    }
++
+     signers = wolfSSL_sk_X509_new_null();
+     if (signers == NULL)
+         return NULL;
+ 
+-    if (wolfSSL_d2i_X509(&x509, (const byte**)&p7->pkcs7.singleCert,
+-                         p7->pkcs7.singleCertSz) == NULL) {
++    if (wolfSSL_d2i_X509(&x509, (const byte**)&signerCert,
++                         signerCertSz) == NULL) {
+         wolfSSL_sk_X509_pop_free(signers, NULL);
+         return NULL;
+     }
diff -Nru wolfssl-5.7.2/debian/patches/series wolfssl-5.7.2/debian/patches/series
--- wolfssl-5.7.2/debian/patches/series	2025-08-10 15:17:47.000000000 +0200
+++ wolfssl-5.7.2/debian/patches/series	2026-07-05 23:43:31.000000000 +0200
@@ -5,3 +5,19 @@
 disable-crl-monitor.patch
 disable-jobserver.patch
 handle-debian-files.diff
+CVE-2026-5194.patch
+CVE-2026-55962.patch
+CVE-2026-55967.patch
+CVE-2026-6092.patch
+CVE-2026-6094.patch
+CVE-2026-6329.patch
+CVE-2026-6331.patch
+CVE-2026-6678.patch
+CVE-2026-6681.patch
+CVE-2026-6731.patch
+CVE-2026-6325.patch
+CVE-2026-55961.patch
+CVE-2026-7511.patch
+CVE-2026-6450.patch
+CVE-2026-55960.patch
+CVE-2026-5194-digest-sizes.patch