https://vulnogram.org/ Most recent CVEs assigned by wolfSSL Inc. (wolfssl). https://vulnogram.org/seaview/icons/wolfssl.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-84897 https://vulnogram.org/CVE-2026-84897 src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_REPLY (33) when a server receives them from an unauthenticated client. IsMessageAl… Medium Network Exploitable Wed, 07 Oct 2026 02:42:28 GMT https://vulnogram.org/CVE-2026-83742 https://vulnogram.org/CVE-2026-83742 Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a cr… Medium Wed, 07 Oct 2026 02:41:48 GMT https://vulnogram.org/CVE-2026-83540 https://vulnogram.org/CVE-2026-83540 When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login po… High Wed, 07 Oct 2026 02:40:35 GMT https://vulnogram.org/CVE-2026-81535 https://vulnogram.org/CVE-2026-81535 In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in num… Medium Network Exploitable Wed, 07 Oct 2026 02:39:27 GMT https://vulnogram.org/CVE-2026-16516 https://vulnogram.org/CVE-2026-16516 wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/… Critical Network Exploitable Wed, 07 Oct 2026 02:38:23 GMT https://vulnogram.org/CVE-2026-15442 https://vulnogram.org/CVE-2026-15442 In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use-after free. If an application ended up getting a partial wolfSSL_read() which is sometimes… Low Sun, 27 Sep 2026 09:24:31 GMT https://vulnogram.org/CVE-2026-89102 https://vulnogram.org/CVE-2026-89102 In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVE_CERTIFICATE_STATUS_REQUE… High Network Exploitable Sun, 27 Sep 2026 09:22:42 GMT https://vulnogram.org/CVE-2026-89133 https://vulnogram.org/CVE-2026-89133 wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf c… Medium Network Exploitable Sun, 27 Sep 2026 09:18:43 GMT https://vulnogram.org/CVE-2026-89134 https://vulnogram.org/CVE-2026-89134 A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->altNames == NULL && !cert->isC… Medium Network Exploitable Sun, 27 Sep 2026 09:16:58 GMT https://vulnogram.org/CVE-2026-89135 https://vulnogram.org/CVE-2026-89135 A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM verify). This affects version 5.8.4 through… Medium Network Exploitable Sun, 27 Sep 2026 09:14:44 GMT https://vulnogram.org/CVE-2026-89136 https://vulnogram.org/CVE-2026-89136 When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and o… High Network Exploitable Sun, 27 Sep 2026 09:12:39 GMT https://vulnogram.org/CVE-2026-93302 https://vulnogram.org/CVE-2026-93302 MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and load CA certificates with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_ce… High Network Exploitable Sun, 27 Sep 2026 09:07:35 GMT https://vulnogram.org/CVE-2026-93304 https://vulnogram.org/CVE-2026-93304 A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known (deterministic) key and checks the server's Fin… Medium Network Exploitable Sun, 27 Sep 2026 09:05:37 GMT https://vulnogram.org/CVE-2026-94417 https://vulnogram.org/CVE-2026-94417 When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information Access OCSP URL, and accepts a certificate the loa… Low Sun, 27 Sep 2026 09:00:59 GMT https://vulnogram.org/CVE-2026-94418 https://vulnogram.org/CVE-2026-94418 Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signature result back only when the parse returned 0, so a… Low Sun, 27 Sep 2026 08:58:56 GMT https://vulnogram.org/CVE-2026-94419 https://vulnogram.org/CVE-2026-94419 Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index, hash(sessionID)} into the process-global SessionCache, and ClientSessionToSession() validates it against that… Low Sun, 27 Sep 2026 08:54:18 GMT https://vulnogram.org/CVE-2026-81341 https://vulnogram.org/CVE-2026-81341 wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the additional authenticated data. Because the record layer leaves the explicit-non… Medium Network Exploitable Fri, 28 Aug 2026 14:43:43 GMT https://vulnogram.org/CVE-2026-81020 https://vulnogram.org/CVE-2026-81020 wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key a… High Network Exploitable Fri, 28 Aug 2026 14:42:59 GMT https://vulnogram.org/CVE-2026-81019 https://vulnogram.org/CVE-2026-81019 wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key… High Network Exploitable Fri, 28 Aug 2026 14:42:01 GMT https://vulnogram.org/CVE-2026-7511 https://vulnogram.org/CVE-2026-7511 PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bound, permitting a forged signature to be accepted. Medium Thu, 25 Jun 2026 21:32:29 GMT https://vulnogram.org/CVE-2026-7532 https://vulnogram.org/CVE-2026-7532 iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certificate to bypass an issuing CA's IP address constraints. Medium Thu, 25 Jun 2026 21:31:11 GMT https://vulnogram.org/CVE-2026-8720 https://vulnogram.org/CVE-2026-8720 wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitiali… Medium Thu, 25 Jun 2026 21:18:29 GMT https://vulnogram.org/CVE-2026-10098 https://vulnogram.org/CVE-2026-10098 OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared seri… Medium Network Exploitable Thu, 25 Jun 2026 21:16:45 GMT https://vulnogram.org/CVE-2026-11703 https://vulnogram.org/CVE-2026-11703 Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-… Medium Thu, 25 Jun 2026 21:15:20 GMT https://vulnogram.org/CVE-2026-55962 https://vulnogram.org/CVE-2026-55962 TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certifica… Medium Thu, 25 Jun 2026 21:12:38 GMT https://vulnogram.org/CVE-2026-6092 https://vulnogram.org/CVE-2026-6092 When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC. Low Thu, 25 Jun 2026 21:06:20 GMT https://vulnogram.org/CVE-2026-6325 https://vulnogram.org/CVE-2026-6325 Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write past the bounds of the destination buffer. Low Thu, 25 Jun 2026 21:04:31 GMT https://vulnogram.org/CVE-2026-6329 https://vulnogram.org/CVE-2026-6329 PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted. The PKCS#12 verify path compared the locally computed HMAC against the MAC parsed from the… Medium Thu, 25 Jun 2026 21:02:45 GMT https://vulnogram.org/CVE-2026-6330 https://vulnogram.org/CVE-2026-6330 The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the… Medium Network Exploitable Thu, 25 Jun 2026 21:01:19 GMT https://vulnogram.org/CVE-2026-6331 https://vulnogram.org/CVE-2026-6331 HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC verify path the supplied signature length was only checked as not exceeding the MAC… Low Thu, 25 Jun 2026 20:56:25 GMT https://vulnogram.org/CVE-2026-6412 https://vulnogram.org/CVE-2026-6412 Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing. Low Thu, 25 Jun 2026 20:38:29 GMT https://vulnogram.org/CVE-2026-6450 https://vulnogram.org/CVE-2026-6450 A CRL critical extension bypass exists in ParseCRL_Extensions where critical extensions are not properly enforced, allowing a crafted CRL with an unhandled critical extension to be accepted. This only affects builds with CRL support enabled and where… Low Thu, 25 Jun 2026 20:18:53 GMT https://vulnogram.org/CVE-2026-6678 https://vulnogram.org/CVE-2026-6678 Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption. Low Thu, 25 Jun 2026 20:16:08 GMT https://vulnogram.org/CVE-2026-6679 https://vulnogram.org/CVE-2026-6679 A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized… High Network Exploitable Thu, 25 Jun 2026 20:13:06 GMT https://vulnogram.org/CVE-2026-6681 https://vulnogram.org/CVE-2026-6681 The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release. Low Thu, 25 Jun 2026 20:11:39 GMT https://vulnogram.org/CVE-2026-6731 https://vulnogram.org/CVE-2026-6731 X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted. Medium Thu, 25 Jun 2026 20:08:13 GMT https://vulnogram.org/CVE-2026-7531 https://vulnogram.org/CVE-2026-7531 Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger the error cleanup path to operate on freed… Low Network Exploitable Thu, 25 Jun 2026 20:01:16 GMT https://vulnogram.org/CVE-2026-10097 https://vulnogram.org/CVE-2026-10097 wolfSSL's AVX2-optimized ML-KEM implementation (mlkem_cmp_avx2) compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check in ML-KEM-1024 decapsulation. Ciphertexts that differ from the expected re-encryption sole… High Network Exploitable Thu, 25 Jun 2026 19:59:30 GMT https://vulnogram.org/CVE-2026-10512 https://vulnogram.org/CVE-2026-10512 The X25519 x86_64 assembly implementation fails to clear the most significant bit during the final modular reduction, so the computed result may not be fully reduced modulo the field prime 2^255 - 19. This can leave the field element in a non-canonic… Low Thu, 25 Jun 2026 19:58:16 GMT https://vulnogram.org/CVE-2026-10592 https://vulnogram.org/CVE-2026-10592 Certificates with wildcard DNS SANs (e.g. *.example.com) bypassed CA name-constraint checks. A certificate with a wildcard DNS SAN that should be rejected by the issuing CA's permitted/excluded DNS name constraints could be accepted. Medium Network Exploitable Thu, 25 Jun 2026 19:40:11 GMT https://vulnogram.org/CVE-2026-11310 https://vulnogram.org/CVE-2026-11310 X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra (OPENSSL_EXTRA) and whose application validates certificates by calling X509_verify_cert() wi… High Network Exploitable Thu, 25 Jun 2026 19:38:19 GMT https://vulnogram.org/CVE-2026-12340 https://vulnogram.org/CVE-2026-12340 Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier computation reads the trailing 65 bytes of the public key without checking that the key is at… Medium Network Exploitable Thu, 25 Jun 2026 19:36:21 GMT https://vulnogram.org/CVE-2026-55958 https://vulnogram.org/CVE-2026-55958 Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding the fixed message bag (MSGBAG_SIZE) sets an error code but fails to return, so execution falls through to an XMEMCPY that writes pas… High Network Exploitable Thu, 25 Jun 2026 19:35:21 GMT https://vulnogram.org/CVE-2026-55960 https://vulnogram.org/CVE-2026-55960 Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative() accepts it without performing any trust verification; it must therefore only be accep… High Network Exploitable Thu, 25 Jun 2026 19:31:55 GMT https://vulnogram.org/CVE-2026-55964 https://vulnogram.org/CVE-2026-55964 Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key Usage extension is present, but chain-supplied temporary CAs (WOLFSSL_TEMP_CA) added while… Medium Network Exploitable Thu, 25 Jun 2026 19:30:34 GMT https://vulnogram.org/CVE-2026-11999 https://vulnogram.org/CVE-2026-11999 X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra whose application calls X509_verify_cert() with caller-supplied untru… High Network Exploitable Thu, 25 Jun 2026 16:56:14 GMT https://vulnogram.org/CVE-2026-55967 https://vulnogram.org/CVE-2026-55967 AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming APIs, allowing counter wrap, keystream reuse, and consequent plaintext recovery. Low Thu, 25 Jun 2026 16:53:14 GMT https://vulnogram.org/CVE-2026-55961 https://vulnogram.org/CVE-2026-55961 wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibil… High Network Exploitable Thu, 25 Jun 2026 16:51:18 GMT https://vulnogram.org/CVE-2026-6091 https://vulnogram.org/CVE-2026-6091 Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An attacker could present a chain that ends at an intermediate they control and have it accep… Medium Thu, 25 Jun 2026 16:46:12 GMT https://vulnogram.org/CVE-2026-6291 https://vulnogram.org/CVE-2026-6291 Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA PKCS#1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decr… Medium Thu, 25 Jun 2026 16:41:42 GMT