wolfSSL vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-83540 When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not rHigh 7.7 · Oct 6, 2026
• CVE-2026-16516 wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange.Critical 9 · Oct 6, 2026
• CVE-2026-93302 MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification.High 8.3 · Sep 27, 2026
• CVE-2026-89136 When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowHigh 8.3 · Sep 27, 2026
• CVE-2026-89102 In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate fHigh 8.3 · Sep 27, 2026
• CVE-2026-81020 wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record.High 7.4 · Aug 28, 2026
• CVE-2026-81019 wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record.High 7.4 · Aug 28, 2026
• CVE-2026-6679 A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated.High 8.8 · Jun 25, 2026
• CVE-2026-55960 Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation.High 8.2 · Jun 25, 2026
• CVE-2026-55958 Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer.High 8.3 · Jun 25, 2026
• CVE-2026-11310 X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()).High 8.7 · Jun 25, 2026
• CVE-2026-10097 wolfSSL's AVX2-optimized ML-KEM implementation (mlkem_cmp_avx2) compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check High 8.3 · Jun 25, 2026
• CVE-2026-55961 wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer.High 8.2 · Jun 25, 2026
• CVE-2026-11999 X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()).High 8.2 · Jun 25, 2026
• CVE-2026-5477 An integer overflow existed in the wolfCrypt CMAC implementation, that could be exploited to forge CMAC tags.High 8.2 · Apr 10, 2026
• CVE-2026-5501 wolfSSL_X509_verify_cert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies aHigh 8.6 · Apr 10, 2026
• CVE-2026-5500 wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check.High 8.7 · Apr 10, 2026
• CVE-2026-5479 In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSL_EVP_CipherFinal (and related EVP cipher finalization functions) fails to verify thHigh 7.6 · Apr 10, 2026
• CVE-2026-5466 wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r` and `s` scalars from the signature blob via `mp_read_unsigned_bin` with no check that thHigh 7.6 · Apr 10, 2026
• CVE-2026-5264 Heap buffer overflow in DTLS 1.3 ACK message processing.High 8.3 · Apr 9, 2026
• CVE-2026-5263 URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c.High 7 · Apr 9, 2026
• CVE-2026-5194 Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant keCritical 9.3 · Apr 9, 2026
• CVE-2026-3547 Out-of-bounds read in ALPN parsing due to incomplete validation.High 7.5 · Mar 19, 2026
• CVE-2026-3548 Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storingHigh 7.2 · Mar 19, 2026
• CVE-2025-15346 A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be fullyCritical 9.3 · Jan 7, 2026