new file mode 100644
@@ -0,0 +1,32 @@
+From f162b7679bafacd5b9866d72400b1115f8fbc7b7 Mon Sep 17 00:00:00 2001
+From: Kareem <kareem@wolfssl.com>
+Date: Fri, 3 Apr 2026 16:05:44 -0700
+Subject: [PATCH] Ensure esd->signedAttribsCount contains the correct count in
+ case some are skipped by using the current idx rather than the total array
+ size.
+
+Thanks to Zou Dikai for the report.
+
+(cherry picked from commit 7f218574c4d30a8aa8c520c7023c3d017fc13b86)
+
+CVE: CVE-2026-6094
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/7f218574c4d30a8aa8c520c7023c3d017fc13b86]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ wolfcrypt/src/pkcs7.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
+index 3f6649d0a..67803f84d 100644
+--- a/wolfcrypt/src/pkcs7.c
++++ b/wolfcrypt/src/pkcs7.c
+@@ -2253,7 +2253,7 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
+ idx++;
+ }
+
+- esd->signedAttribsCount += cannedAttribsCount;
++ esd->signedAttribsCount += idx;
+ esd->signedAttribsSz += (word32)EncodeAttributes(
+ &esd->signedAttribs[atrIdx], (int)idx, cannedAttribs,
+ (int)cannedAttribsCount);
new file mode 100644
@@ -0,0 +1,35 @@
+From 6d7fe2926a18982278c53b4ec413fe7b2349a019 Mon Sep 17 00:00:00 2001
+From: Kareem <kareem@wolfssl.com>
+Date: Fri, 3 Apr 2026 16:06:35 -0700
+Subject: [PATCH] In wc_PKCS7_DecodeEnvelopedData, confirm
+ encryptedContentTotalSz does not exceed the total message size before using
+ it in the non-streaming case.
+
+Thanks to Zou Dikai for the report.
+
+(cherry picked from commit 1397268aa12e2cf3f80c3acfa9b6036b809c08ef)
+
+CVE: CVE-2026-6094
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/1397268aa12e2cf3f80c3acfa9b6036b809c08ef]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ wolfcrypt/src/pkcs7.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
+index 67803f84d..43bcf3ee4 100644
+--- a/wolfcrypt/src/pkcs7.c
++++ b/wolfcrypt/src/pkcs7.c
+@@ -13231,6 +13231,11 @@ int wc_PKCS7_DecodeEnvelopedData(wc_PKCS7* pkcs7, byte* in,
+ }
+ wc_PKCS7_DecryptContentFree(pkcs7, encOID, pkcs7->heap);
+ } else {
++ if ((idx + (word32)encryptedContentTotalSz) > pkiMsgSz) {
++ ret = BUFFER_E;
++ break;
++ }
++
+ pkcs7->cachedEncryptedContentSz =
+ (word32)encryptedContentTotalSz;
+ pkcs7->totalEncryptedContentSz =
new file mode 100644
@@ -0,0 +1,39 @@
+From c7f7a8ef00e6a7a33a623543507f8fa089f6037b Mon Sep 17 00:00:00 2001
+From: Kareem <kareem@wolfssl.com>
+Date: Fri, 3 Apr 2026 16:56:04 -0700
+Subject: [PATCH] Code review feedback
+
+(cherry picked from commit ebdcc03b718cd7175355097b1a3831a0eb4875b2)
+
+CVE: CVE-2026-6094
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/ebdcc03b718cd7175355097b1a3831a0eb4875b2]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ wolfcrypt/src/pkcs7.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
+index 43bcf3ee4..50d33bdb8 100644
+--- a/wolfcrypt/src/pkcs7.c
++++ b/wolfcrypt/src/pkcs7.c
+@@ -2256,7 +2256,7 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
+ esd->signedAttribsCount += idx;
+ esd->signedAttribsSz += (word32)EncodeAttributes(
+ &esd->signedAttribs[atrIdx], (int)idx, cannedAttribs,
+- (int)cannedAttribsCount);
++ (int)idx);
+ atrIdx += idx;
+ } else {
+ esd->signedAttribsCount = 0;
+@@ -13231,7 +13231,9 @@ int wc_PKCS7_DecodeEnvelopedData(wc_PKCS7* pkcs7, byte* in,
+ }
+ wc_PKCS7_DecryptContentFree(pkcs7, encOID, pkcs7->heap);
+ } else {
+- if ((idx + (word32)encryptedContentTotalSz) > pkiMsgSz) {
++ word32 tmpSum;
++ if (!WC_SAFE_SUM_WORD32(idx, (word32)encryptedContentTotalSz, tmpSum) ||
++ tmpSum > pkiMsgSz) {
+ ret = BUFFER_E;
+ break;
+ }
new file mode 100644
@@ -0,0 +1,36 @@
+From a9015491db03d415f766f47c139841249adce843 Mon Sep 17 00:00:00 2001
+From: Kareem <kareem@wolfssl.com>
+Date: Mon, 6 Apr 2026 11:58:12 -0700
+Subject: [PATCH] Fix unused variable error
+
+(cherry picked from commit 3e04475875a4942652fdf6794a01fdfd65801fdc)
+
+CVE: CVE-2026-6094
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/3e04475875a4942652fdf6794a01fdfd65801fdc]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ wolfcrypt/src/pkcs7.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
+index 50d33bdb8..2cde73846 100644
+--- a/wolfcrypt/src/pkcs7.c
++++ b/wolfcrypt/src/pkcs7.c
+@@ -2197,7 +2197,6 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
+ #endif
+ word32 idx = 0;
+ word32 atrIdx = 0;
+- word32 cannedAttribsCount;
+
+ if (pkcs7 == NULL || esd == NULL || contentType == NULL ||
+ contentTypeOid == NULL || messageDigestOid == NULL ||
+@@ -2220,8 +2219,6 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
+ return timeSz;
+ #endif
+
+- cannedAttribsCount = sizeof(cannedAttribs)/sizeof(PKCS7Attrib);
+-
+ XMEMSET(&cannedAttribs[idx], 0, sizeof(cannedAttribs[idx]));
+
+ if ((pkcs7->defaultSignedAttribs & WOLFSSL_CONTENT_TYPE_ATTRIBUTE) ||
new file mode 100644
@@ -0,0 +1,73 @@
+From c27fbdecfd2f4a31acdc73229a5bc631184265f1 Mon Sep 17 00:00:00 2001
+From: Kareem <kareem@wolfssl.com>
+Date: Mon, 6 Apr 2026 16:41:32 -0700
+Subject: [PATCH] Add additional checks for encryptedContentSz exceeding
+ pkiMsgSz.
+
+(cherry picked from commit b3c2877a146e0c75715368ca5dfe2387bfc2cadf)
+
+CVE: CVE-2026-6094
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/b3c2877a146e0c75715368ca5dfe2387bfc2cadf]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ wolfcrypt/src/pkcs7.c | 38 ++++++++++++++++++++++++++------------
+ 1 file changed, 26 insertions(+), 12 deletions(-)
+
+diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
+index 2cde73846..8df3a2430 100644
+--- a/wolfcrypt/src/pkcs7.c
++++ b/wolfcrypt/src/pkcs7.c
+@@ -14380,9 +14380,17 @@ int wc_PKCS7_DecodeAuthEnvelopedData(wc_PKCS7* pkcs7, byte* in,
+ }
+
+ if (ret == 0) {
+- XMEMCPY(encryptedContent, &pkiMsg[idx],
++ word32 tmpSum;
++ if (!WC_SAFE_SUM_WORD32(idx, (word32)encryptedContentSz,
++ tmpSum) ||
++ tmpSum > pkiMsgSz) {
++ ret = BUFFER_E;
++ break;
++ } else {
++ XMEMCPY(encryptedContent, &pkiMsg[idx],
+ (word32)encryptedContentSz);
+- idx += (word32)encryptedContentSz;
++ idx += (word32)encryptedContentSz;
++ }
+ }
+ #ifndef NO_PKCS7_STREAM
+ pkcs7->stream->bufferPt = encryptedContent;
+@@ -15316,16 +15324,22 @@ int wc_PKCS7_DecodeEncryptedData(wc_PKCS7* pkcs7, byte* in, word32 inSz,
+ }
+
+ if (ret == 0) {
+- XMEMCPY(encryptedContent, &pkiMsg[idx],
+- (unsigned int)encryptedContentSz);
+- idx += (word32)encryptedContentSz;
+-
+- /* decrypt encryptedContent */
+- ret = wc_PKCS7_DecryptContent(pkcs7, encOID,
+- pkcs7->encryptionKey, pkcs7->encryptionKeySz,
+- tmpIv, expBlockSz, NULL, 0, NULL, 0,
+- encryptedContent, encryptedContentSz,
+- encryptedContent, pkcs7->devId, pkcs7->heap);
++ word32 tmpSum;
++ if (!WC_SAFE_SUM_WORD32(idx, (word32)encryptedContentSz, tmpSum) ||
++ tmpSum > pkiMsgSz) {
++ ret = BUFFER_E;
++ } else {
++ XMEMCPY(encryptedContent, &pkiMsg[idx],
++ (unsigned int)encryptedContentSz);
++ idx += (word32)encryptedContentSz;
++
++ /* decrypt encryptedContent */
++ ret = wc_PKCS7_DecryptContent(pkcs7, encOID,
++ pkcs7->encryptionKey, pkcs7->encryptionKeySz,
++ tmpIv, expBlockSz, NULL, 0, NULL, 0,
++ encryptedContent, encryptedContentSz,
++ encryptedContent, pkcs7->devId, pkcs7->heap);
++ }
+ if (ret != 0) {
+ XFREE(encryptedContent, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
+ }
@@ -23,6 +23,11 @@ SRC_URI = " \
file://CVE-2026-6091-2.patch \
file://CVE-2026-6091-3.patch \
file://CVE-2026-6092.patch \
+ file://CVE-2026-6094-1.patch \
+ file://CVE-2026-6094-2.patch \
+ file://CVE-2026-6094-3.patch \
+ file://CVE-2026-6094-4.patch \
+ file://CVE-2026-6094-5.patch \
"
SRCREV = "1d363f3adceba9d1478230ede476a37b0dcdef24"