From: Sander van Deijck <sander@vandeijck.com>
Date: Wed, 12 Aug 2026 23:26:01 +0000 (+0200)
Subject: wolfssl: update to 5.9.2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c84523a6b68f0f4d5e11ddef2e194283e1382fed;p=thirdparty%2Fopenwrt.git

wolfssl: update to 5.9.2

Release notes:
https://github.com/wolfSSL/wolfssl/releases/tag/v5.9.2-stable

This is a security release fixing 32 CVEs (6 High, 15 Med, 11 Low).
Many of them apply to the configuration built here: --enable-opensslall
and --enable-opensslextra are unconditional, and TLS 1.3, session
tickets and OCSP stapling default to y.

Fixes CVEs:
- CVE-2026-11310 (High)
- CVE-2026-11999 (High)
- CVE-2026-6679 (High)
- CVE-2026-55958 (High)
- CVE-2026-55960 (High)
- CVE-2026-55961 (High)
- CVE-2026-6731 (Med)
- CVE-2026-6091 (Med)
- CVE-2026-6094 (Med)
- CVE-2026-6329 (Med)
- CVE-2026-6330 (Med)
- CVE-2026-8720 (Med)
- CVE-2026-10097 (Med)
- CVE-2026-10098 (Med)
- CVE-2026-10592 (Med)
- CVE-2026-7532 (Med)
- CVE-2026-6291 (Med)
- CVE-2026-7511 (Med)
- CVE-2026-11703 (Med)
- CVE-2026-55962 (Med)
- CVE-2026-55964 (Med)
- CVE-2026-6092 (Low)
- CVE-2026-6331 (Low)
- CVE-2026-6681 (Low)
- CVE-2026-10512 (Low)
- CVE-2026-6678 (Low)
- CVE-2026-7531 (Low)
- CVE-2026-6325 (Low)
- CVE-2026-6412 (Low)
- CVE-2026-6450 (Low)
- CVE-2026-12340 (Low)
- CVE-2026-55967 (Low)

OCSP responder authorization is now strictly enforced per RFC 6960
4.2.2.2. The CheckOcspResponderChain() fallback, which accepted any
responder certificate issued by an ancestor of the target's issuer,
was removed. Setups relying on an indirectly issued OCSP responder
will start to fail validation.

Refreshed patches.

Signed-off-by: Sander van Deijck <sander@vandeijck.com>
Link: https://github.com/openwrt/openwrt/pull/24700
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---

diff --git a/package/libs/wolfssl/Makefile b/package/libs/wolfssl/Makefile
index 958a569a4e3..37725d6d524 100644
--- a/package/libs/wolfssl/Makefile
+++ b/package/libs/wolfssl/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wolfssl
-PKG_VERSION:=5.9.1
+PKG_VERSION:=5.9.2
 PKG_REAL_VERSION:=$(PKG_VERSION)-stable
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_REAL_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/wolfSSL/wolfssl/archive/v$(PKG_REAL_VERSION)
-PKG_HASH:=d5ca7af48cd2d9a91d539e9baedeba55a0605a28d7ac8b01dc3d5254a13ca341
+PKG_HASH:=2f4ef3d4fd387a9b3191d36a6316d69116c46ff69bb9583b6c82b36d7b8ca114
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_REAL_VERSION)
 
diff --git a/package/libs/wolfssl/patches/100-disable-hardening-check.patch b/package/libs/wolfssl/patches/100-disable-hardening-check.patch
index a31905ad892..e7cd333c77d 100644
--- a/package/libs/wolfssl/patches/100-disable-hardening-check.patch
+++ b/package/libs/wolfssl/patches/100-disable-hardening-check.patch
@@ -1,6 +1,6 @@
 --- a/wolfssl/wolfcrypt/settings.h
 +++ b/wolfssl/wolfcrypt/settings.h
-@@ -4154,7 +4154,7 @@ extern void uITRON4_free(void *p) ;
+@@ -4281,7 +4281,7 @@
  
  /* warning for not using harden build options (default with ./configure) */
  /* do not warn if big integer support is disabled */