Wolfssl vulnerabilities, page 4
171 vulnerabilities
Known vulnerabilities in Wolfssl products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 8 products.
RoutineCVE-2026-5504wolfssl +3 morePKCS7 CBC Padding Oracle — Plaintext RecoveryA padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated.CVSS6.3MediumEPSS0.11%RoutineCVE-2026-5507wolfssl +3 moreSession Cache Restore — Arbitrary Free via Deserialized PointerWhen restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cache and for the application to call specific session restore APIs.CVSS4.1MediumEPSS0.17%RoutineCVE-2026-5772wolfssl +3 moreMatchDomainName 1-Byte Stack Buffer Over-Read in Hostname ValidationA 1-byte stack buffer over-read was identified in the MatchDomainName function (src/internal.c) during wildcard hostname validation when the LEFT_MOST_WILDCARD_ONLY flag is active. If a wildcard * exhausts the entire hostname string, the function reads one byte past the buffer without a bounds check, which could cause a crash.CVSS5.3MediumEPSS0.23%RoutineCVE-2026-5778wolfssl +3 moreInteger underflow leads to out-of-bounds access in sniffer ChaCha decrypt path.Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in the AEAD decryption path by injecting a TLS record shorter than the explicit IV plus authentication tag into traffic inspected by ssl_DecodePacket. The underflow wraps a 16-bit length to a large value that is passed to AEAD decryption routines, causing a large out-of-bounds read and crash. An unauthenticated attacker can trigger this remotely via malformed TLS Application Data records.CVSS6.5MediumEPSS0.22%PrioritiseCVE-2026-5264wolfssl +3 moreDTLS 1.3 ACK heap buffer overflowHeap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow.CVSS9.8CriticalEPSS0.45%RoutineCVE-2026-5263wolfssl +3 moreURI nameConstraints not enforced in ConfirmNameConstraints()URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised or malicious sub-CA could issue leaf certificates with URI SAN entries that violate the nameConstraints of the issuing CA, and wolfSSL would accept them as valid.CVSS7.0HighEPSS0.18%RoutineCVE-2026-5446wolfssl +3 morewolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuseIn wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wc_AriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is zero-initialized at session setup and never incremented in non-FIPS builds. This vulnerability affects wolfSSL builds configured with --enable-aria and the proprietary MagicCrypto SDK (a non-default, opt-in configuration required for Korean regulatory deployments). AES-GCM is not affected because wc_AesGcmEncrypt_ex maintains an internal invocation counter independently of the call-site guard.CVSS7.1HighEPSS0.33%RoutineCVE-2026-5447wolfssl +3 moreHeap buffer overflow in CertFromX509() via AuthorityKeyIdentifierA heap buffer overflow occurs when converting an X.509 certificate internally due to incorrect size handling of the AuthorityKeyIdentifier extension.CVSS7.5HighEPSS0.34%RoutineCVE-2026-5187wolfssl +3 moreHeap Out-of-Bounds Write in DecodeObjectId() in wolfSSLTwo potential heap out-of-bounds write locations existed in DecodeObjectId() in wolfcrypt/src/asn.c. First, a bounds check only validates one available slot before writing two OID arc values (out[0] and out[1]), enabling a 2-byte out-of-bounds write when outSz equals 1. Second, multiple callers pass sizeof(decOid) (64 bytes on 64-bit platforms) instead of the element count MAX_OID_SZ (32), causing the function to accept crafted OIDs with 33 or more arcs that write past the end of the allocated buffer.CVSS9.8CriticalEPSS0.28%PrioritiseCVE-2026-5194wolfssl +3 morewolfSSL ECDSA Certificate VerificationMissing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA certificate-based authentication if the public CA key used is also known. This affects ECDSA/ECC verification when EdDSA or ML-DSA is also enabled.CVSS9.3CriticalEPSS0.57%RoutineCVE-2026-4159wolfssl +3 morewc_PKCS7_DecodeEnvelopedData 1 byte out-of-bounds read1-byte OOB heap read in wc_PKCS7_DecodeEnvelopedData via zero-length encrypted content. A vulnerability existed in wolfSSL 5.8.4 and earlier, where a 1-byte out-of-bounds heap read in wc_PKCS7_DecodeEnvelopedData could be triggered by a crafted CMS EnvelopedData message with zero-length encrypted content. Note that PKCS7 support is disabled by default.CVSS3.3LowEPSS0.10%RoutineCVE-2026-3229wofssl · wolfssl +4 moreInteger Overflow in Certificate Chain AllocationAn integer overflow vulnerability existed in the static function wolfssl_add_to_chain, that caused heap corruption when certificate data was written out of bounds of an insufficiently sized certificate buffer. wolfssl_add_to_chain is called by these API: wolfSSL_CTX_add_extra_chain_cert, wolfSSL_CTX_add1_chain_cert, wolfSSL_add0_chain_cert. These API are enabled for 3rd party compatibility features: enable-opensslall, enable-opensslextra, enable-lighty, enable-stunnel, enable-nginx, enable-haproxy. This issue is not remotely exploitable, and would require that the application context loading certificates is compromised.CVSS5.5MediumEPSS0.07%RoutineCVE-2026-3230wolfssl +3 moreImproper key_share validation in TLS 1.3 HelloRetryRequestMissing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS-protected communications via a crafted HelloRetryRequest followed by a ServerHello message that omits the required key_share extension, resulting in derivation of predictable traffic secrets from (EC)DHE shared secret. This issue does not affect the client's authentication of the server during TLS handshakes.CVSS2.7LowEPSS0.22%RoutineCVE-2026-4395wolfssl +3 moreHeap-based buffer overflow in wc_ecc_import_x963_ex KCAPI pathHeap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-controlled data past the bounds of the pubkey_raw buffer via a crafted oversized EC public key point. The WOLFSSL_KCAPI_ECC code path copies the input to key->pubkey_raw (132 bytes) using XMEMCPY without a bounds check, unlike the ATECC code path which includes a length validation. This can be triggered during TLS key exchange when a malicious peer sends a crafted ECPoint in ServerKeyExchange.CVSS9.8CriticalEPSS0.35%RoutineCVE-2026-3849wolfssl inc. · wolfssl +4 moreBuffer Overflow in HPKE via Oversized ECH ConfigStack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH (Encrypted Client Hello) support, where a maliciously crafted ECH config could cause a stack buffer overflow on the client side, leading to potential remote execution and client program crash. This could be exploited by a malicious TLS server supporting ECH. Note that ECH is off by default, and is only enabled with enable-ech.CVSS9.8CriticalEPSS0.45%PrioritiseCVE-2026-3547wolfssl +3 morewolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validationOut-of-bounds read in ALPN parsing due to incomplete validation. wolfSSL 5.8.4 and earlier contained an out-of-bounds read in ALPN handling when built with ALPN enabled (HAVE_ALPN / --enable-alpn). A crafted ALPN protocol list could trigger an out-of-bounds read, leading to a potential process crash (denial of service). Note that ALPN is disabled by default, but is enabled for these 3rd party compatibility features: enable-apachehttpd, enable-bind, enable-curl, enable-haproxy, enable-hitch, enable-lighty, enable-jni, enable-nginx, enable-quic.CVSS7.5HighEPSS0.29%PrioritiseCVE-2026-3549wofssl · wolfssl +4 moreECH parsing heap buffer overflowHeap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extension parsing logic when calculating a buffer length, which resulted in writing beyond the bounds of an allocated buffer. Note that in wolfSSL, ECH is off by default, and the ECH standard is still evolving.CVSS9.8CriticalEPSS0.50%RoutineCVE-2026-3580wolfssl +3 moreCompiler-induced timing leak in sp_256_get_entry_256_9 on RISC-VIn wolfSSL 5.8.4, constant-time masking logic in sp_256_get_entry_256_9 is optimized into conditional branches (bnez) by GCC when targeting RISC-V RV32I with -O3. This transformation breaks the side-channel resistance of ECC scalar multiplication, potentially allowing a local attacker to recover secret keys via timing analysis.CVSS4.7MediumEPSS0.13%RoutineCVE-2026-3579wolfssl +3 moreNon-constant time multiplication subroutine __muldi3 on RISC-V RV32IwolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time software implementation for 64-bit multiplication. The compiler-inserted __muldi3 subroutine executes in variable time based on operand values. This affects multiple SP math functions (sp_256_mul_9, sp_256_sqr_9, etc.), leading to a timing side-channel that may expose sensitive cryptographic data.CVSS5.9MediumEPSS0.27%RoutineCVE-2026-3503wolfssl inc. · wolfssl (wolfcrypt) +4 moreFault injection attack with ML-DSA and ML-KEM on ARMProtection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion.
This issue affects wolfSSL (wolfCrypt): commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6.CVSS5.2MediumEPSS0.16%