diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6325.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6325.patch
new file mode 100644
index 0000000000..5a67a30dc0
--- /dev/null
+++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6325.patch
@@ -0,0 +1,123 @@
+From b47170ed386de50deb3f1ce7c9f39cdb17630fc0 Mon Sep 17 00:00:00 2001
+From: Sean Parkinson <sean@wolfssl.com>
+Date: Wed, 15 Apr 2026 11:39:26 +1000
+Subject: [PATCH] Merge pull request #10204 from mattia-moffa/20260413-fixes
+
+SetSuitesHashSigAlgo fix
+
+(cherry picked from commit 6ac0f82b8589736e15683b7d94a822681b8949fc)
+
+CVE: CVE-2026-6325
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/6ac0f82b8589736e15683b7d94a822681b8949fc]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/internal.c | 11 ++++++++++
+ tests/api.c    | 58 +++++++++++++++++++++++++++-----------------------
+ 2 files changed, 42 insertions(+), 27 deletions(-)
+
+diff --git a/src/internal.c b/src/internal.c
+index 267c75a5d..769ba6764 100644
+--- a/src/internal.c
++++ b/src/internal.c
+@@ -29546,6 +29546,17 @@ int SetSuitesHashSigAlgo(Suites* suites, const char* list)
+                     break;
+                 }
+             }
++            {
++                word32 needed = 2;
++#if defined(WC_RSA_PSS) && defined(WOLFSSL_TLS13)
++                if (sig_alg == rsa_pss_sa_algo)
++                    needed = 4;
++#endif
++                if ((word32)idx + needed > WOLFSSL_MAX_SIGALGO) {
++                    ret = 0;
++                    break;
++                }
++            }
+             AddSuiteHashSigAlgo(suites->hashSigAlgo, mac_alg, sig_alg, 0, &idx);
+             sig_alg = 0;
+             mac_alg = no_mac;
+diff --git a/tests/api.c b/tests/api.c
+index 78fcf13ce..739cf0c68 100644
+--- a/tests/api.c
++++ b/tests/api.c
+@@ -15878,6 +15878,33 @@ static int test_wolfSSL_set1_sigalgs_list(void)
+                     WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
+         ExpectIntEQ(wolfSSL_set1_sigalgs_list(ssl, "RSA+SHA256+RSA"),
+                     WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
++
++        {
++            const char entry[] = "RSA+SHA256";
++            const int entryLen = (int)sizeof(entry) - 1;
++            const int entries = WOLFSSL_MAX_SIGALGO + 1;
++            int listSz = entries * (entryLen + 1);
++            char* longList = (char*)XMALLOC(listSz, NULL,
++                DYNAMIC_TYPE_TMP_BUFFER);
++            int i;
++            int pos = 0;
++
++            ExpectNotNull(longList);
++            if (longList != NULL) {
++                for (i = 0; i < entries; i++) {
++                    if (i != 0)
++                        longList[pos++] = ':';
++                    XMEMCPY(longList + pos, entry, entryLen);
++                    pos += entryLen;
++                }
++                longList[pos] = '\0';
++                ExpectIntEQ(wolfSSL_CTX_set1_sigalgs_list(ctx, longList),
++                    WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
++                ExpectIntEQ(wolfSSL_set1_sigalgs_list(ssl, longList),
++                    WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
++                XFREE(longList, NULL, DYNAMIC_TYPE_TMP_BUFFER);
++            }
++        }
+     #endif
+ #endif
+ #ifdef HAVE_ECC
+@@ -35744,7 +35771,6 @@ static int test_pkcs7_padding(void)
+     int outSz;
+     int ctOff = -1;
+     int ctLen = 0;
+-    int i;
+ 
+     XMEMSET(key, 0xAA, sizeof(key));
+     XMEMSET(plaintext, 'X', sizeof(plaintext));
+@@ -35767,32 +35793,10 @@ static int test_pkcs7_padding(void)
+         (word32)encodedSz, output, sizeof(output)), (int)sizeof(plaintext));
+     wc_PKCS7_Free(&pkcs7);
+ 
+-    /* Find ciphertext block in encoded DER */
+-    if (EXPECT_SUCCESS()) {
+-        for (i = encodedSz - 10; i > 10; i--) {
+-            if (encoded[i] == 0x04 || encoded[i] == 0x80) {
+-                int len, lbytes;
+-
+-                if (encoded[i+1] < 0x80) {
+-                    len = encoded[i+1]; lbytes = 1;
+-                }
+-                else if (encoded[i+1] == 0x81) {
+-                    len = encoded[i+2]; lbytes = 2;
+-                }
+-                else {
+-                    continue;
+-                }
+-                if (len > 0 && len % 16 == 0 &&
+-                    i + 1 + lbytes + len <= encodedSz) {
+-                    ctOff = i + 1 + lbytes;
+-                    ctLen = len;
+-                    break;
+-                }
+-            }
+-        }
+-    }
+-    ExpectIntGT(ctOff, 0);
+-    ExpectIntGE(ctLen, 32);
++    /* encryptedContent is the last element in the DER, so it ends at encodedSz;
++     * 27-byte plaintext -> 32-byte AES-256-CBC ciphertext. */
++    ctLen = 32;
++    ctOff = encodedSz - ctLen;
+ 
+     /* Corrupt an interior padding byte via CBC bit-flip */
+     if (EXPECT_SUCCESS()) {
diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
index 5569df4d56..843d5071b4 100644
--- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
+++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
@@ -29,6 +29,7 @@ SRC_URI = " \
     file://CVE-2026-6094-4.patch \
     file://CVE-2026-6094-5.patch \
     file://CVE-2026-6291.patch \
+    file://CVE-2026-6325.patch \
 "
 
 SRCREV = "1d363f3adceba9d1478230ede476a37b0dcdef24"