Wolfssl
by WolfSSL
Source repositories
CVEs (143)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-6094 | Cri | 0.52 | 9.1 | 0.00 | Jun 25, 2026 | Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS. | ||
| CVE-2026-5393 | Cri | 0.52 | 9.1 | 0.00 | Apr 10, 2026 | Dual-Algorithm CertificateVerify out-of-bounds read. When processing a dual-algorithm CertificateVerify message, an out-of-bounds read can occur on crafted input. This can only occur when --enable-experimental and --enable-dual-alg-certs is used when building wolfSSL. | ||
| CVE-2026-5503 | Cri | 0.52 | 9.1 | 0.00 | Apr 9, 2026 | In TLSX_EchChangeSNI, the ctx->extensions branch set extensions unconditionally even when TLSX_Find returned NULL. This caused TLSX_UseSNI to attach the attacker-controlled publicName to the shared WOLFSSL_CTX when no inner SNI was configured. TLSX_EchRestoreSNI then failed to… | ||
| CVE-2026-5194 | Cri | 0.52 | 9.1 | 0.00 | Apr 9, 2026 | Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA… | ||
| CVE-2017-8854 | Hig | 0.51 | 7.8 | 0.02 | May 9, 2017 | wolfSSL before 3.10.2 has an out-of-bounds memory access with loading crafted DH parameters, aka a buffer overflow triggered by a malformed temporary DH file. | ||
| CVE-2022-39173 | Hig | 0.49 | 7.5 | 0.04 | Sep 29, 2022 | In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required… | ||
| CVE-2014-2904 | Hig | 0.49 | 7.5 | 0.01 | Nov 21, 2019 | wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication. | ||
| CVE-2014-2902 | Hig | 0.49 | 7.5 | 0.01 | Nov 21, 2019 | wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates. | ||
| CVE-2014-2901 | Hig | 0.49 | 7.5 | 0.01 | Nov 21, 2019 | wolfssl before 3.2.0 does not properly issue certificates for a server's hostname. | ||
| CVE-2019-18840 | Hig | 0.49 | 7.5 | 0.02 | Nov 9, 2019 | In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer overflow inside the DecodedCert structure in GetName in wolfcrypt/src/asn.c because the… | ||
| CVE-2017-8855 | Hig | 0.49 | 7.5 | 0.01 | May 9, 2017 | wolfSSL before 3.11.0 does not prevent wc_DhAgree from accepting a malformed DH key. | ||
| CVE-2015-6925 | Hig | 0.49 | 7.5 | 0.03 | Jan 22, 2016 | wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or traffic amplification) via a crafted DTLS cookie in a ClientHello message. | ||
| CVE-2026-5501 | Hig | 0.46 | 8.1 | 0.00 | Apr 10, 2026 | wolfSSL_X509_verify_cert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies an untrusted intermediate with Basic Constraints `CA:FALSE` that is legitimately signed by a trusted root. An attacker… | ||
| CVE-2026-5479 | Hig | 0.46 | 8.1 | 0.00 | Apr 10, 2026 | In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSL_EVP_CipherFinal (and related EVP cipher finalization functions) fails to verify the authentication tag before returning plaintext to the caller. When an application uses the EVP API to perform… | ||
| CVE-2026-5466 | Hig | 0.46 | 8.1 | 0.00 | Apr 10, 2026 | wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r` and `s` scalars from the signature blob via `mp_read_unsigned_bin` with no check that they lie in `[1, q-1]`. A crafted forged signature could verify against any message for any identity, using only… | ||
| CVE-2026-5188 | Hig | 0.46 | 8.1 | 0.00 | Apr 10, 2026 | An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can specify an entry length larger than the enclosing sequence, causing the internal length counter to wrap during parsing. This… | ||
| CVE-2026-2646 | Hig | 0.46 | 8.1 | 0.00 | Mar 19, 2026 | A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to… | ||
| CVE-2020-15309 | Hig | 0.46 | 7.0 | 0.00 | Aug 21, 2020 | An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a cache-timing attack against public key operations. These attackers may already have obtained sensitive information if the affected system has been used for… | ||
| CVE-2026-5295 | Hig | 0.45 | 8.0 | 0.00 | Apr 9, 2026 | A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wc_PKCS7_DecryptOri() function in wolfcrypt/src/pkcs7.c. When processing a CMS EnvelopedData message containing an OtherRecipientInfo (ORI) recipient, the function copies an ASN.1-parsed OID into a fixed… | ||
| CVE-2024-2881 | Med | 0.44 | 6.7 | 0.00 | Aug 30, 2024 | Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer… |
- risk 0.52cvss 9.1epss 0.00
Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS.
- risk 0.52cvss 9.1epss 0.00
Dual-Algorithm CertificateVerify out-of-bounds read. When processing a dual-algorithm CertificateVerify message, an out-of-bounds read can occur on crafted input. This can only occur when --enable-experimental and --enable-dual-alg-certs is used when building wolfSSL.
- risk 0.52cvss 9.1epss 0.00
In TLSX_EchChangeSNI, the ctx->extensions branch set extensions unconditionally even when TLSX_Find returned NULL. This caused TLSX_UseSNI to attach the attacker-controlled publicName to the shared WOLFSSL_CTX when no inner SNI was configured. TLSX_EchRestoreSNI then failed to…
- risk 0.52cvss 9.1epss 0.00
Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA…
- risk 0.51cvss 7.8epss 0.02
wolfSSL before 3.10.2 has an out-of-bounds memory access with loading crafted DH parameters, aka a buffer overflow triggered by a malformed temporary DH file.
- risk 0.49cvss 7.5epss 0.04
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required…
- risk 0.49cvss 7.5epss 0.01
wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication.
- risk 0.49cvss 7.5epss 0.01
wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.
- risk 0.49cvss 7.5epss 0.01
wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.
- risk 0.49cvss 7.5epss 0.02
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer overflow inside the DecodedCert structure in GetName in wolfcrypt/src/asn.c because the…
- risk 0.49cvss 7.5epss 0.01
wolfSSL before 3.11.0 does not prevent wc_DhAgree from accepting a malformed DH key.
- risk 0.49cvss 7.5epss 0.03
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or traffic amplification) via a crafted DTLS cookie in a ClientHello message.
- risk 0.46cvss 8.1epss 0.00
wolfSSL_X509_verify_cert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies an untrusted intermediate with Basic Constraints `CA:FALSE` that is legitimately signed by a trusted root. An attacker…
- risk 0.46cvss 8.1epss 0.00
In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSL_EVP_CipherFinal (and related EVP cipher finalization functions) fails to verify the authentication tag before returning plaintext to the caller. When an application uses the EVP API to perform…
- risk 0.46cvss 8.1epss 0.00
wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r` and `s` scalars from the signature blob via `mp_read_unsigned_bin` with no check that they lie in `[1, q-1]`. A crafted forged signature could verify against any message for any identity, using only…
- risk 0.46cvss 8.1epss 0.00
An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can specify an entry length larger than the enclosing sequence, causing the internal length counter to wrap during parsing. This…
- risk 0.46cvss 8.1epss 0.00
A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to…
- risk 0.46cvss 7.0epss 0.00
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a cache-timing attack against public key operations. These attackers may already have obtained sensitive information if the affected system has been used for…
- risk 0.45cvss 8.0epss 0.00
A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wc_PKCS7_DecryptOri() function in wolfcrypt/src/pkcs7.c. When processing a CMS EnvelopedData message containing an OtherRecipientInfo (ORI) recipient, the function copies an ASN.1-parsed OID into a fixed…
- risk 0.44cvss 6.7epss 0.00
Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer…
Page 2 of 8