By vendor

Wolfssl vulnerabilities

Known CVEs affecting Wolfssl products, prioritized by severity, with SEC.co remediation and detection guidance.

30 published vulnerabilities

• CVE-2026-10097HIGH 7.5

  wolfSSL's optimized implementation of ML-KEM-1024, a post-quantum key encapsulation mechanism, contains a critical flaw in how it validates ciphertexts during decryption. The vulnerability stems from an incomplete cryptographic check: the library compares only 1536 of the required 1568 ciphertext bytes when verifying that a ciphertext was correctly re-encrypted. This allows an attacker to craft malicious ciphertexts that pass validation when they should be rejected. An attacker with access to a decapsulation oracle can exploit this as a side-channel-like oracle to recover the long-term private key—without needing to exploit timing behavior or other indirect measurements. A proof of concept demonstrated recovery of a full private key using roughly 350 carefully chosen ciphertexts, with approximately 98% success rate.

• CVE-2026-10512HIGH 7.5

  A cryptographic error in WolfSSL's X25519 implementation can produce incorrect encryption keys. The vulnerability stems from incomplete mathematical reduction in the elliptic curve algorithm's final step, potentially leaving computed values in an invalid state. This could result in Diffie-Hellman key exchanges that don't match expectations, though the impact depends on how applications use the affected library and whether they validate results.

• CVE-2026-11310HIGH 7.5

  wolfSSL contains a certificate validation flaw that allows attackers to present fraudulent certificate chains that bypass trust verification. This happens only when applications use wolfSSL's OpenSSL compatibility layer to manually verify certificates (rather than relying on wolfSSL's native TLS verification). An attacker can craft a certificate chain with a self-signed or untrusted intermediate certificate that the vulnerable code mistakenly accepts as valid, potentially enabling impersonation attacks across S/MIME, code signing, JWT validation, and other PKI-dependent protocols.

• CVE-2026-11703HIGH 7.5

  A flaw in WolfSSL allows an attacker to reuse a cached TLS session in a different virtual-hosting context than the one where it was originally authenticated. When a client reconnects using a saved session, the library failed to verify that the server name (SNI) and protocol settings (ALPN) matched the original connection. If authentication requirements differ across virtual hosts, an attacker could bypass those checks by resuming a session meant for one host in the security context of another. The fix ensures all session resumptions now validate SNI and ALPN bindings, falling back to a full handshake if they don't match.

• CVE-2026-11999HIGH 7.5

  A flaw in wolfSSL's OpenSSL compatibility layer allows attackers to bypass certificate trust validation in certain configurations. When an application uses wolfSSL's X509_verify_cert() function with untrusted intermediate certificates and the certificate chain exceeds 100 levels deep, the library incorrectly accepts the chain without verifying it reaches a trusted root certificate. This only affects applications built with OpenSSL compatibility mode enabled that manually perform certificate verification; standard TLS connections are not vulnerable.

• CVE-2026-12340HIGH 7.5

  A flaw in WolfSSL's SM2/SM3 certificate signature verification can cause the application to crash when processing specially crafted certificates. The vulnerability occurs because the code reads 65 bytes from a public key without first verifying the key is long enough, potentially accessing memory beyond allocated bounds. This affects only builds compiled with SM2 support enabled. There is no data corruption or information disclosure risk—the primary impact is denial of service through application crashes.

• CVE-2026-55958HIGH 7.5

  A memory corruption vulnerability exists in WolfSSL's Renesas TSIP TLS 1.3 implementation that allows a remote attacker to crash a device by sending an oversized TLS handshake message. The underlying flaw occurs because the code checks whether incoming transcript data exceeds a fixed 8 KB buffer but neglects to stop processing after flagging the error—instead, it continues copying data anyway, writing beyond the buffer boundary. This heap corruption can trigger a denial of service on affected embedded systems. The vulnerability only manifests when using the specific Renesas TSIP hardware acceleration on compatible Renesas microcontrollers running WolfSSL with TLS 1.3 client mode enabled.

• CVE-2026-55960HIGH 7.5

  CVE-2026-55960 is a certificate validation bypass vulnerability in wolfSSL that allows an attacker to present a raw public key as a valid certificate even when raw public keys were never negotiated with the peer. Normally, raw public keys have no chain of trust and should only be accepted in TLS connections where both sides explicitly agreed to use them. This vulnerability bypasses that check, potentially allowing an attacker to impersonate a legitimate server or client. The flaw only affects wolfSSL builds compiled with Raw Public Key (RPK) support enabled, which is off by default in standard builds but included when using the --enable-all compilation flag.

• CVE-2026-55961HIGH 7.5

  wolfSSL's PKCS#7 verification function returns success for certificate-only bundles that contain no actual signatures. This means applications relying on PKCS#7_verify() to authenticate content will incorrectly believe unsigned or improperly signed objects are legitimate. An attacker can craft a degenerate PKCS#7 bundle with empty signature data, and if your application processes it, the verification function falsely confirms its authenticity. This is particularly dangerous for code-signing, email verification, or document authentication workflows.

• CVE-2026-55967HIGH 7.5

  A cryptographic flaw in wolfSSL's AES-GCM streaming implementation fails to reject messages larger than 64 GiB, causing the encryption counter to wrap around and reuse the same keystream. This allows attackers to recover plaintext from encrypted data without knowing the encryption key. The vulnerability requires network access and no authentication, making it a serious confidentiality risk for any application using wolfSSL's streaming APIs with large messages.

• CVE-2026-6325HIGH 7.5

  A memory corruption vulnerability exists in WolfSSL's signature algorithm processing code. When the library receives a specially crafted TLS message with an abnormally large list of signature algorithms, it writes data beyond the allocated buffer boundaries. This out-of-bounds write can corrupt adjacent memory, potentially allowing an attacker to modify application behavior or crash the service. The flaw requires no authentication and can be triggered over the network during the TLS handshake.

• CVE-2026-6331HIGH 7.5

  A cryptographic validation weakness in WolfSSL's HMAC verification allows forged or truncated message authentication codes to be accepted as valid. The vulnerability exists in the EVP_DigestVerifyFinal function, where the system fails to strictly validate that a supplied signature matches the full expected length. An attacker can craft a zero-length or shortened tag that passes verification when it should be rejected, potentially allowing tampered messages to be accepted as authentic.

• CVE-2026-6679HIGH 7.5

  A memory corruption flaw exists in wolfSSL's DTLS 1.3 implementation that allows an unauthenticated remote attacker to crash affected services. The vulnerability stems from incorrect math when calculating the size of a data structure, resulting in a smaller buffer being allocated than needed. When the code then writes data into this undersized buffer, it corrupts adjacent memory and triggers a denial of service. This can happen before the connecting peer has proven its identity, making it exploitable by anyone on the network.

• CVE-2026-6731HIGH 7.5

  CVE-2026-6731 is a flaw in how X.509 certificate name constraints are validated. Specifically, when a certificate's Subject Common Name (CN) is processed as a DNS hostname, an attacker can bypass the name constraints that a trusted certificate authority imposed. This means a certificate could be issued that violates the CA's policy—for example, claiming to be for a domain it should not be allowed to represent. The flaw affects wolfSSL and has a CVSS score of 7.5 (HIGH), indicating moderate-to-high risk due to the integrity impact on certificate validation.

• CVE-2026-7511HIGH 7.5

  A flaw in PKCS#7 signature verification allows an attacker to forge digital signatures by manipulating which signer is associated with a signature. The vulnerability fails to correctly bind the signer identity to the signature itself, meaning a forged signature can be validated as authentic. This undermines the core trust mechanism of digital signatures—non-repudiation and identity verification.

• CVE-2026-7532HIGH 7.5

  A vulnerability in wolfSSL allows certificates with invalid IP address restrictions to be accepted when a specific compile-time flag is not enabled. Certificate authorities can impose IP address constraints to limit where a certificate is trusted; this flaw bypasses that protection, potentially allowing a fraudulent certificate to be used from unauthorized network locations.

• CVE-2026-8720HIGH 7.5

  wolfSSL's HMAC-BLAKE2 implementation contains a critical flaw where oversized cryptographic keys cause the authentication mechanism to ignore the actual message content. When a key exceeds BLAKE2's block size, the library discards previously accumulated message data and resets its internal state, resulting in a message authentication code (MAC) that depends only on the key—not on what is being authenticated. This means an attacker could substitute arbitrary data and still produce a valid MAC if they know or control the key, fundamentally breaking message authentication for affected implementations. The vulnerability is confined to HMAC-BLAKE2 APIs introduced in wolfSSL 5.9.0 and later.

• CVE-2026-55962MEDIUM 6.5

  A flaw in wolfSSL's TLS 1.3 implementation allows servers to incorrectly accept client authentication messages without verifying the client actually sent the required cryptographic proof of identity. This happens specifically when a server requests client authentication after the initial handshake is complete. The vulnerability only affects servers using wolfSSL's post-handshake authentication feature and does not impact typical clients or servers that perform all authentication during the initial connection setup.

• CVE-2026-6091MEDIUM 6.5

  A vulnerability in wolfSSL's certificate verification logic may incorrectly accept X.509 certificate chains that end at an intermediate certificate controlled by an attacker, rather than terminating at a trusted root authority. When the partial-chain verification flag is enabled in OpenSSL-compatible code, an attacker with low privileges can craft a malicious certificate chain that bypasses the normal validation requirements. This could allow the attacker to impersonate legitimate services or intercept communications in scenarios where certificate pinning or strict chain validation is relied upon for security.

• CVE-2026-6291MEDIUM 6.5

  wolfSSL's PKCS#7 encryption decryption contains a timing-based information leak that allows attackers to recover encryption keys. When decrypting encrypted messages using RSA, the library returned different error messages depending on whether the encryption padding was valid or the message contents were corrupt. An attacker with network access could exploit this distinction by sending specially crafted encrypted messages and analyzing the responses to gradually reconstruct the underlying encryption key, similar to historical Bleichenbacher attacks. The vulnerability requires authenticated access (login credentials) and affects confidentiality of encrypted data but not integrity or system availability.

• CVE-2026-6329MEDIUM 6.5

  A vulnerability in wolfSSL's PKCS#12 implementation allows attackers to bypass the integrity check (MAC—Message Authentication Code) that protects the contents of PKCS#12 certificate bundles. The flaw stems from comparing the stored MAC against the computed one using a length value supplied by the attacker, rather than enforcing the correct digest length. An attacker can supply a truncated or zero-length MAC that will be incorrectly accepted, meaning a tampered PKCS#12 file could pass validation even though its contents have been altered. This is particularly dangerous in supply-chain or key-distribution scenarios where PKCS#12 files are expected to be cryptographically signed and verified.

• CVE-2026-6330MEDIUM 6.5

  A cryptographic implementation flaw in WolfSSL's ML-KEM (a post-quantum key encapsulation mechanism) on ARM64 systems causes incomplete validation of encrypted data. The implementation's constant-time comparison logic only checks half of the expected ciphertext, allowing an attacker to send a manipulated ciphertext that bypasses the security mechanism designed to reject invalid or tampered data. This weakens the encryption's resistance to certain sophisticated attacks, though the real-world impact depends on how the library is deployed in applications.

• CVE-2026-10098MEDIUM 5.3

  A flaw in wolfSSL's OCSP (Online Certificate Status Protocol) certificate revocation checking allows an attacker to cause the library to report incorrect revocation status for a certificate. Specifically, if an OCSP response contains status information for a certificate whose serial number is shorter and matches the beginning of another certificate's serial number (both issued by the same CA), wolfSSL could incorrectly report the wrong certificate's revocation status. This happens because the code compared serial numbers byte-by-byte without first checking that they were the same length. An attacker controlling an OCSP responder or intercepting OCSP traffic could exploit this to make a revoked certificate appear valid or vice versa.

• CVE-2026-10592MEDIUM 5.3

  A certificate validation flaw in wolfSSL allowed digital certificates with wildcard DNS names (like *.example.com) to bypass security constraints that should have rejected them. Certificate authorities use name constraints to limit which domains a certificate can be used for—this vulnerability meant those restrictions could be circumvented by using a wildcard entry, potentially allowing an attacker to use a certificate in ways the CA never intended to permit.

• CVE-2026-55964MEDIUM 5.3

  wolfSSL's certificate verification code accepted intermediate CA certificates that claimed to be signing authorities (CA:TRUE) without properly checking that they possessed the required signing capability (keyCertSign). This loophole applied specifically to temporary CAs injected during certificate chain building in OpenSSL-compatible mode, not to user-loaded root certificates. An attacker could potentially use a malformed intermediate certificate in a chain to bypass security checks and gain unauthorized signing privileges, though actual exploitation depends on how applications use the verified certificate chain.

• CVE-2026-6092MEDIUM 5.3

  CVE-2026-6092 is a cryptographic implementation flaw in WolfSSL where the library may unexpectedly downgrade from the stronger Encrypt-then-MAC mode to the weaker MAC-then-Encrypt mode, even when configured to enforce Encrypt-then-MAC. This downgrade weakens the integrity guarantees of TLS connections by allowing potential plaintext recovery attacks. An attacker on the network can exploit this without authentication to read sensitive data transmitted over affected connections.

• CVE-2026-6450MEDIUM 5.3

  A flaw in how WolfSSL processes certificate revocation lists (CRLs) allows specially crafted CRLs with unrecognized critical extensions to bypass validation checks. When a CRL carries a valid signature, the library should reject any critical extensions it doesn't understand—but this implementation fails to do so. An attacker could supply a malicious CRL that appears legitimate to certificate validation logic, potentially leading to acceptance of certificates that should have been revoked. This affects only WolfSSL builds compiled with CRL support enabled.

• CVE-2026-6678MEDIUM 5.3

  A flaw in wolfSSL's PKCS#7 decryption function can cause incorrect handling of encrypted data when processing specially crafted messages. The vulnerability stems from an integer underflow—a mathematical error where a calculation produces a value smaller than intended—affecting how the library determines the length of decrypted content. While this does not expose encrypted data or allow an attacker to decrypt messages they shouldn't access, it can cause the decryption process to fail or behave unexpectedly, potentially leading to a denial of service.

• CVE-2026-6681MEDIUM 5.3

  wolfSSL versions 5.9.0 and earlier contain a buffer overflow vulnerability in their PKCS#7 decoding functionality. When applications call the PKCS#7 decoder and provide a buffer along with its size, the decoder ignores the size limit and writes decoded data beyond the buffer boundary. An unauthenticated remote attacker can exploit this to corrupt memory and potentially modify application state or behavior. The vulnerability was patched in wolfSSL 5.9.1.

• CVE-2026-6412MEDIUM 4.3

  CVE-2026-6412 is a medium-severity certificate handling issue in WolfSSL in which the library continues to accept SHA-1 and MD5 hashing algorithms when processing X.509 certificates, despite these algorithms being cryptographically obsolete and violating modern RFC 8446 (TLS 1.3) compliance requirements. An authenticated attacker could exploit this to bypass certificate validation controls, potentially enabling man-in-the-middle attacks or acceptance of fraudulent certificates within encrypted sessions. The vulnerability requires prior authentication and does not directly compromise confidentiality, but does introduce integrity risks through improper certificate chain validation.