Improper input validation in Wolfssl
CVE-2026-3230
Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS-protected communications via a crafted HelloRetryRequest followed by a ServerHello message that omits the required key_share extension, resulting in derivation of predictable traffic secrets from (EC)DHE shared secret. This issue does not affect the client's authentication of the server during TLS handshakes.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.002 (11.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Wolfssl — versions 0
Weakness classification (CWE)
References
- facts@wolfssl.com (Patch, Issue Tracking)
Frequently asked questions
- What is CVE-2026-3230?
- CVE-2026-3230 is a low-severity vulnerability in Wolfssl, classified under Improper Input Validation. CVSS score: 2.7/10. Published 2026-03-19.
- How severe is CVE-2026-3230?
- Low severity. CVSS v3 base score is 2.7 out of 10.