Wolfssl Inc. Wolfssl vulnerabilities
2 vulnerabilities
Known vulnerabilities in Wolfssl Inc. Wolfssl, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2026-3849wolfssl inc. · wolfssl +4 moreBuffer Overflow in HPKE via Oversized ECH ConfigStack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH (Encrypted Client Hello) support, where a maliciously crafted ECH config could cause a stack buffer overflow on the client side, leading to potential remote execution and client program crash. This could be exploited by a malicious TLS server supporting ECH. Note that ECH is off by default, and is only enabled with enable-ech.CVSS9.8CriticalEPSS0.45%RoutineCVE-2024-5288wolfssl inc. · wolfssl +3 moreSafe-error attack on TLS 1.3 ProtocolAn issue was discovered in wolfSSL before 5.7.0. A safe-error attack via Rowhammer, namely FAULT+PROBE, leads to ECDSA key disclosure. When WOLFSSL_CHECK_SIG_FAULTS is used in signing operations with private ECC keys,
such as in server-side TLS connections, the connection is halted if any fault occurs. The success rate in a certain amount of connection requests can be processed via an advanced technique for ECDSA key recovery.CVSS5.9MediumEPSS0.42%