CVE-2026-94417 | Medium | 5.3 | 2026-09-27 | When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certifica… |
CVE-2026-93304 | | | 2026-09-27 | A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the cli… |
CVE-2026-93302 | | | 2026-09-27 | MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEE… |
CVE-2026-89136 | | | 2026-09-27 | When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allo… |
CVE-2026-89135 | | | 2026-09-27 | A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sib… |
CVE-2026-89134 | | | 2026-09-27 | A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-a… |
CVE-2026-89133 | | | 2026-09-27 | wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when… |
CVE-2026-89102 | | | 2026-09-27 | In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate… |
CVE-2026-15442 | | | 2026-09-27 | In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use… |
CVE-2026-94419 | | | 2026-09-27 | Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index, hash(sessionID)} in… |
CVE-2026-94418 | | | 2026-09-27 | Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges th… |
CVE-2026-81341 | Medium | 6.5 | 2026-08-28 | wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number car… |
CVE-2026-81020 | High | 7.4 | 2026-08-28 | wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TL… |
CVE-2026-81019 | High | 7.4 | 2026-08-28 | wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every… |
CVE-2026-8720 | High | 7.5 | 2026-06-25 | wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. W… |
CVE-2026-7532 | High | 7.5 | 2026-06-25 | iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certi… |
CVE-2026-7511 | High | 7.5 | 2026-06-25 | PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bound, permitting a forged signature to b… |
CVE-2026-6331 | High | 7.5 | 2026-06-25 | HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibilit… |
CVE-2026-6330 | Medium | 6.5 | 2026-06-25 | The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA… |
CVE-2026-6329 | Medium | 6.5 | 2026-06-25 | PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted… |
CVE-2026-6325 | High | 7.5 | 2026-06-25 | Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write past the bounds of the destination buffer. |
CVE-2026-6092 | Medium | 5.3 | 2026-06-25 | When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC. |
CVE-2026-55962 | Medium | 6.5 | 2026-06-25 | TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the client having sent a Certificate and Cert… |
CVE-2026-11703 | High | 7.5 | 2026-06-25 | Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for ticket-based resumption. A cached sessio… |
CVE-2026-10098 | Medium | 5.3 | 2026-06-25 | OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose serial is a prefix of the target serial t… |
CVE-2026-6731 | High | 7.5 | 2026-06-25 | X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name cons… |
CVE-2026-6681 | Medium | 5.3 | 2026-06-25 | The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer… |
CVE-2026-6679 | High | 7.5 | 2026-06-25 | A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an intege… |
CVE-2026-6678 | Medium | 5.3 | 2026-06-25 | Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption. |
CVE-2026-6450 | Medium | 5.3 | 2026-06-25 | A CRL critical extension bypass exists in ParseCRL_Extensions where critical extensions are not properly enforced, allowing a crafted CRL with an unhandled cri… |
CVE-2026-6412 | Medium | 4.3 | 2026-06-25 | Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing. |
CVE-2026-7531 | Critical | 9.8 | 2026-06-25 | Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a… |
CVE-2026-55964 | Medium | 5.3 | 2026-06-25 | Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key… |
CVE-2026-55960 | High | 7.5 | 2026-06-25 | Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelat… |
CVE-2026-55958 | High | 7.5 | 2026-06-25 | Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding the fixed message bag (MSGBAG_SIZE) sets… |
CVE-2026-12340 | High | 7.5 | 2026-06-25 | Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier com… |
CVE-2026-11310 | High | 7.5 | 2026-06-25 | X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra (O… |
CVE-2026-10592 | Medium | 5.3 | 2026-06-25 | Certificates with wildcard DNS SANs (e.g. *.example.com) bypassed CA name-constraint checks. A certificate with a wildcard DNS SAN that should be rejected by t… |
CVE-2026-10512 | High | 7.5 | 2026-06-25 | The X25519 x86_64 assembly implementation fails to clear the most significant bit during the final modular reduction, so the computed result may not be fully r… |
CVE-2026-10097 | High | 7.5 | 2026-06-25 | wolfSSL's AVX2-optimized ML-KEM implementation (mlkem_cmp_avx2) compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check… |
CVE-2026-6291 | Medium | 6.5 | 2026-06-25 | Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA PKCS#1 v1.5 key transport, wolfSSL returned distinguish… |
CVE-2026-6094 | Critical | 9.1 | 2026-06-25 | Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data… |
CVE-2026-6091 | Medium | 6.5 | 2026-06-25 | Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An… |
CVE-2026-55967 | High | 7.5 | 2026-06-25 | AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming APIs, allowing counter… |
CVE-2026-55961 | High | 7.5 | 2026-06-25 | wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the unde… |
CVE-2026-11999 | High | 7.5 | 2026-06-25 | X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with… |
CVE-2026-0930 | Medium | 4.3 | 2026-04-20 | Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read… |
CVE-2026-5477 | High | 7.5 | 2026-04-10 | An integer overflow existed in the wolfCrypt CMAC implementation, that could be exploited to forge CMAC tags. The function wc_CmacUpdate used the guard `if (cm… |
CVE-2026-5501 | High | 8.1 | 2026-04-10 | wolfSSL_X509_verify_cert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies… |
CVE-2026-5500 | Medium | 5.9 | 2026-04-10 | wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-… |
CVE-2026-5479 | High | 8.1 | 2026-04-10 | In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSL_EVP_CipherFinal (and related EVP cipher finalization functions) fails to verify t… |
CVE-2026-5466 | High | 8.1 | 2026-04-10 | wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r` and `s` scalars from the signature blob via `mp_read_unsigned_bin` with no check that t… |
CVE-2026-5188 | High | 8.1 | 2026-04-10 | An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can speci… |
CVE-2026-5460 | Medium | 6.5 | 2026-04-10 | A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare processing. In the error handling path of TLSX_KeyShare_Proce… |
CVE-2026-5448 | Medium | 4.3 | 2026-04-10 | X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. A buffer overflow may occur when parsing date fields from a crafted X.509 certifi… |
CVE-2026-5393 | Critical | 9.1 | 2026-04-10 | Dual-Algorithm CertificateVerify out-of-bounds read. When processing a dual-algorithm CertificateVerify message, an out-of-bounds read can occur on crafted inp… |
CVE-2026-5392 | Medium | 5.4 | 2026-04-10 | Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 message can trigger an OOB read on the heap. The missing bounds check is in the indefinite-length end… |
CVE-2026-5507 | Medium | 4.0 | 2026-04-09 | When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the… |
CVE-2026-5504 | Medium | 5.3 | 2026-04-09 | A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified c… |
CVE-2026-5503 | Critical | 9.1 | 2026-04-09 | In TLSX_EchChangeSNI, the ctx->extensions branch set extensions unconditionally even when TLSX_Find returned NULL. This caused TLSX_UseSNI to attach the attack… |
CVE-2026-5295 | High | 8.0 | 2026-04-09 | A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wc_PKCS7_DecryptOri() function in wolfcrypt/src/pkcs7.c. When processing a CMS Envelope… |
CVE-2026-5778 | Medium | 6.5 | 2026-04-09 | Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in the AEAD decryption path by injecting a TLS record shorter… |
CVE-2026-5772 | Medium | 5.3 | 2026-04-09 | A 1-byte stack buffer over-read was identified in the MatchDomainName function (src/internal.c) during wildcard hostname validation when the LEFT_MOST_WILDCARD… |
CVE-2026-5264 | Critical | 9.8 | 2026-04-09 | Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow. |
CVE-2026-5263 | Medium | 6.5 | 2026-04-09 | URI nameConstraints from constrained intermediate CAs are parsed but not enforced during certificate chain verification in wolfcrypt/src/asn.c. A compromised o… |
CVE-2026-5447 | High | 7.5 | 2026-04-09 | Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion. A heap buffer overflow occurs when converting an X.509 certificate internally d… |
CVE-2026-5446 | High | 7.1 | 2026-04-09 | In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wc_AriaEncrypt… |
CVE-2026-5194 | Critical | 9.1 | 2026-04-09 | Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant k… |
CVE-2026-5187 | Critical | 9.8 | 2026-04-09 | Two potential heap out-of-bounds write locations existed in DecodeObjectId() in wolfcrypt/src/asn.c. First, a bounds check only validates one available slot be… |
CVE-2026-4159 | Low | 3.3 | 2026-03-19 | 1-byte OOB heap read in wc_PKCS7_DecodeEnvelopedData via zero-length encrypted content. A vulnerability existed in wolfSSL 5.8.4 and earlier, where a 1-byte ou… |
CVE-2026-4395 | Critical | 9.8 | 2026-03-19 | Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-controlled dat… |
CVE-2026-3849 | Critical | 9.8 | 2026-03-19 | Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH (Encrypted Client Hello) support, where a… |
CVE-2026-3549 | Critical | 9.8 | 2026-03-19 | Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extension parsing logic when calculating a buffer length, which resulted in writing b… |
CVE-2026-3547 | High | 7.5 | 2026-03-19 | Out-of-bounds read in ALPN parsing due to incomplete validation. wolfSSL 5.8.4 and earlier contained an out-of-bounds read in ALPN handling when built with ALP… |
CVE-2026-3230 | Low | 2.7 | 2026-03-19 | Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS… |
CVE-2026-3229 | Medium | 5.5 | 2026-03-19 | An integer overflow vulnerability existed in the static function wolfssl_add_to_chain, that caused heap corruption when certificate data was written out of bou… |
CVE-2026-3580 | Medium | 4.7 | 2026-03-19 | In wolfSSL 5.8.4, constant-time masking logic in sp_256_get_entry_256_9 is optimized into conditional branches (bnez) by GCC when targeting RISC-V RV32I with -… |
CVE-2026-3579 | Medium | 5.9 | 2026-03-19 | wolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time software implementation for 64-bit multiplication. The compiler-inserted __muldi3 subroutine… |
CVE-2026-3503 | Medium | 5.2 | 2026-03-19 | Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attack… |
CVE-2026-3548 | Critical | 9.8 | 2026-03-19 | Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storin… |
CVE-2026-2646 | High | 8.1 | 2026-03-19 | A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certif… |
CVE-2026-2645 | High | 7.5 | 2026-03-19 | In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerif… |
CVE-2026-1005 | Medium | 5.3 | 2026-03-19 | Integer underflow in wolfSSL packet sniffer <= 5.8.4 allows an attacker to cause a buffer overflow in the AEAD decryption path by injecting a TLS record shorte… |
CVE-2026-0819 | High | 7.1 | 2026-03-19 | A stack buffer overflow vulnerability exists in wolfSSL's PKCS7 SignedData encoding functionality. In wc_PKCS7_BuildSignedAttributes(), when adding custom sign… |
CVE-2025-15346 | | | 2026-01-08 | A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be full… |
CVE-2025-15382 | High | 8.1 | 2026-01-06 | A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted… |
CVE-2025-14942 | Critical | 9.8 | 2026-01-06 | wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the cl… |
CVE-2025-13912 | | | 2025-12-11 | Multiple constant-time implementations in wolfSSL before version 5.8.4 may be transformed into non-constant-time binary by LLVM optimizations, which can potent… |
CVE-2025-12889 | Medium | 5.4 | 2025-11-22 | With TLS 1.2 connections a client can use any digest, specifically a weaker digest that is supported, rather than those in the CertificateRequest. |
CVE-2025-12888 | High | 7.5 | 2025-11-21 | Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limit… |
CVE-2025-11936 | Medium | 5.3 | 2025-11-21 | Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a deni… |
CVE-2025-11934 | Low | 2.7 | 2025-11-21 | Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for downgr… |
CVE-2025-11933 | Medium | 6.5 | 2025-11-21 | Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to p… |
CVE-2025-11932 | Medium | 4.3 | 2025-11-21 | The server previously verified the TLS 1.3 PSK binder using a non-constant time method which could potentially leak information about the PSK binder |
CVE-2025-11931 | High | 8.2 | 2025-11-21 | Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a call to the function wc_XChaCha20Poly1305_… |
CVE-2025-11935 | High | 7.5 | 2025-11-21 | With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with… |
CVE-2025-11625 | Critical | 9.8 | 2025-10-21 | Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials. |
CVE-2025-7396 | Medium | 4.6 | 2025-07-18 | In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds. The blinding configure option is only for the base C imp… |
CVE-2025-7395 | | | 2025-07-18 | A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL… |
CVE-2025-7394 | Critical | 9.8 | 2025-07-18 | In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for predictable values re… |