CVE-2026-6291: wolfSSL PKCS#7 Bleichenbacher Padding Oracle Key Recovery

Technical summary

CVE-2026-6291 is a Bleichenbacher padding oracle vulnerability in wolfSSL's PKCS#7 EnvelopedData decryption using RSA PKCS#1 v1.5 key transport. The vulnerability stems from distinct error code returns when RSA padding validation fails versus when decrypted content is malformed. This distinguishability allows an attacker to mount an oracle attack: by submitting crafted EnvelopedData messages and observing error responses, the attacker can iteratively recover the Content Encryption Key (CEK). The attack exploits the cryptographic weakness inherent to PKCS#1 v1.5 padding combined with side-channel information leakage through error differentiation. The fix implements deterministic pseudo-random fake CEK generation (via HMAC-SHA256) on padding failure and uses constant-time operations throughout the decryption path, ensuring all failure modes return identical errors and eliminating the oracle.

Business impact

Organizations deploying wolfSSL to protect sensitive data encrypted via PKCS#7/CMS with RSA encryption face potential key recovery attacks. If an attacker gains authenticated access to a system that decrypts messages, they can systematically extract encryption keys through repeated oracle queries. This could lead to unauthorized decryption of historical and future encrypted communications. The impact scope is confined to confidentiality—decrypted data becomes readable—but does not permit tampering or system compromise. Organizations relying on PKCS#7 encryption for compliance requirements (healthcare, finance) should prioritize patching to maintain cryptographic guarantees. The requirement for authentication significantly reduces the threat surface compared to unauthenticated attacks.

Affected systems

wolfSSL is affected across all versions prior to the fix release. wolfSSL is used in embedded systems, IoT devices, servers, and applications requiring lightweight cryptographic libraries. Any deployment using PKCS#7 EnvelopedData decryption with RSA PKCS#1 v1.5 key transport is vulnerable. This includes usage in VPNs, secure messaging, container orchestration platforms, and firmware. Organizations should identify all systems integrating wolfSSL and verify their current version against the patched release. Note that systems using only DSA, ECDSA, or non-RSA key transport are unaffected.

Exploitability

Exploitation requires authenticated access to a system that decrypts PKCS#7 EnvelopedData messages, representing a meaningful hurdle. However, once authenticated, the oracle attack is straightforward to execute: the attacker sends specialized crafted messages and analyzes response codes across potentially hundreds or thousands of iterations. Each successful oracle query recovers a small amount of key material; full key recovery is computationally feasible. The attack is network-accessible (remote) but not unauthenticated, reducing real-world likelihood in well-secured environments. Insider threats or compromised application accounts represent the primary risk vector.

Remediation

Patch wolfSSL to the version addressing CVE-2026-6291—verify the exact version number from the official wolfSSL advisory. After patching, re-deploy affected applications. For high-value systems, consider rotating encryption keys that may have been protected by vulnerable wolfSSL instances, especially if audit logs suggest potential oracle queries. Verify the patch was applied to all instances (embedded firmware, containers, compiled binaries). Organizations unable to patch immediately should implement network segmentation to limit authenticated access to systems performing PKCS#7 decryption and monitor for suspicious patterns of encryption error responses.

Patch guidance

Apply the wolfSSL security patch immediately to all systems performing PKCS#7 EnvelopedData decryption. Consult the official wolfSSL security advisory for the exact patched version number and installation instructions. Test patches in a staging environment first to ensure compatibility with dependent applications. Prioritize production systems decrypting sensitive data. For embedded or firmware deployments, coordinate with device manufacturers to obtain patched builds. After deployment, verify the fix is active by confirming the library version matches the advisory and conducting functional testing of PKCS#7 decryption workflows.

Detection guidance

Monitor application logs for clusters of PKCS#7 decryption error responses from the same authenticated user or source IP, particularly if error codes vary unpredictably or occur at high frequency. Such patterns may indicate oracle attack probing. Implement alerts on authentication failures immediately preceding decryption errors. Use SIEM rules to detect repeated failed decryption attempts with the same encrypted message payload, a signature of oracle queries. Review wolfSSL library versions in runtime environments using software inventory tools. Inspect network traffic for repeated POST/API requests containing EnvelopedData structures if decryption happens server-side. Correlation of error response timing and content may also reveal the attack, though constant-time implementations complicate this vector.

Why prioritize this

Although the CVSS 3.1 score is 6.5 (Medium), the vulnerability poses a direct confidentiality threat to encrypted data in compliance-sensitive environments. The attack targets cryptographic material itself—encryption keys—rather than peripheral systems. Any organization processing regulated data (PII, healthcare records, financial information) encrypted via PKCS#7 should treat this as high priority despite the Medium rating, because key compromise violates data protection guarantees. The authentication requirement reduces urgency versus network-worm scenarios, but the attack's technical feasibility and the foundational nature of the flaw warrant prompt remediation. Organizations with extensive wolfSSL deployments or high-value encrypted data should prioritize within weeks, not months.

Risk score, explained

CVSS 3.1 assigns 6.5 (Medium) reflecting high confidentiality impact (C:H), low attack complexity (AC:L), network accessibility (AV:N), no integrity or availability impact, and requirement for authentication (PR:L). The Medium rating appropriately captures that the attack demands authenticated access and affects only data confidentiality. However, the *nature* of the compromised confidentiality—encryption keys themselves—warrants organizational assessment independent of the base score. Organizations handling sensitive data should consider context-specific risk elevation. The constant-time fix in patched versions completely eliminates the oracle path, making patching highly effective.

Frequently asked questions