wolfSSL wolfSSL
98 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-15442 | 4.4.0 – 5.9.2 | Heap use-after-free on read during bidirectional (D)TLS shutdown | LOW 2.3 | 0.2 % | ||
| CVE-2026-89102 | 5.7.2 – 5.9.2 | OCSP stapling v2 multi accepts non-CA chain certificates as issuers | HIGH 8.3 | 0.1 % | ||
| CVE-2026-89133 | ≤ 5.9.2 | NameConstraints not enforced across unconstrained intermediate CA | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-89134 | 5.9.2 | Subject CN name-constraint check bypassed when non-DNS SAN present | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-89135 | 5.8.4 – 5.9.2 | Failed X509_verify_cert leaves unverified CA in shared CertManager | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-89136 | 5.6.0 – 5.9.2 | Client accepts unsolicited RawPublicKey server certificate type | HIGH 8.3 | 0.4 % | ||
| CVE-2026-93302 | 5.3.0 – 5.9.2 | Trusted peer certificate match ignores public key, allowing forged CA clones | HIGH 8.3 | 0.2 % | ||
| CVE-2026-93304 | 4.7.0 – 5.9.2 | (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-94417 | ≤ 5.9.2 | CRL check skipped when OCSP enabled and certificate has no OCSP URL | LOW 2.3 | 0.2 % | ||
| CVE-2026-94418 | 3.15.5 – 5.9.2 | Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY | LOW 2.3 | 0.1 % | ||
| CVE-2026-94419 | 5.3.0 – 5.9.2 | Client session cache reference poisoning allows resumption with wrong server | LOW 2.3 | 0.1 % | ||
| CVE-2026-7511 | 3.15.5 – 5.9.1 | PKCS7_verify signer confusion allows forged signatures to be accepted | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-7532 | ≤ 5.9.1 | iPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined | MEDIUM 5.7 | 0.3 % | ||
| CVE-2026-8720 | 5.9.0 – 5.9.1 | HMAC-BLAKE2 final discards message when key length exceeds block size | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-10098 | 4.6.0 – 5.9.1 | OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-11703 | 3.15.0 – 5.9.1 | Missing SNI/ALPN binding on stateful (session-ID) TLS session resumption | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-55962 | 5.5.4 – 5.9.1 | TLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerify | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-6092 | 5.2.0 – 5.9.1 | Encrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE_ENCRYPT_THEN_MAC is configured | LOW 2.1 | 0.4 % | ||
| CVE-2026-6325 | 4.8.0 – 5.9.1 | Out-of-bounds write in SetSuitesHashSigAlgo on oversized signature algorithms list | LOW 2.0 | 0.3 % | ||
| CVE-2026-6329 | 3.10.0 – 5.9.1 | PKCS#12 MAC verification uses attacker-controlled comparison length | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-6330 | 5.7.4 – 5.9.1 | ML-KEM ARM64 NEON ciphertext comparison only compares half of the input | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-6331 | 3.15.5 – 5.9.1 | HMAC zero-length tag forgery in EVP_DigestVerifyFinal | LOW 2.1 | 0.2 % | ||
| CVE-2026-6412 | 3.9.10 – 5.9.1 | Continued acceptance of SHA-1/MD5 digests in certificate processing | LOW 2.3 | 0.1 % | ||
| CVE-2026-6450 | 4.3.0 – 5.9.1 | CRL critical extension bypass in ParseCRL_Extensions | LOW 1.0 | 0.3 % | ||
| CVE-2026-6678 | 3.15.5 – 5.9.1 | Integer underflow in wc_PKCS7_DecryptOri handling crafted Other Recipient Info | LOW 1.0 | 0.3 % | ||
| CVE-2026-6679 | 5.4.0 – 5.9.0 | DTLS 1.3 ACK serialization heap buffer overflow via integer truncation | HIGH 8.8 | 0.5 % | ||
| CVE-2026-6681 | 3.10.0 – 5.9.0 | PKCS#7 decode ignores caller output buffer size, writing past buffer bounds | LOW 1.0 | 0.4 % | ||
| CVE-2026-6731 | 3.9.10 – 5.9.1 | X.509 name constraint bypass via Subject CN treated as a DNS name | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-7531 | 5.8.0 – 5.9.1 | Use-after-free in PQC hybrid key-share handling | LOW 2.3 | 0.5 % | ||
| CVE-2026-10097 | 5.7.0 – 5.9.1 | ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery | HIGH 8.3 | 0.3 % | ||
| CVE-2026-10512 | 5.6.4 – 5.9.1 | X25519 x86_64 assembly final reduction leaves non-canonical field element | LOW 2.3 | 0.5 % | ||
| CVE-2026-10592 | 3.9.10 – 5.9.1 | Wildcard DNS SAN bypasses CA name-constraint checks | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-11310 | 5.8.4 – 5.9.1 | X.509 trust-chain bypass in wolfSSL_X509_verify_cert() via untrusted intermediate anchoring | HIGH 8.7 | 0.2 % | ||
| CVE-2026-12340 | 5.6.4 – 5.9.1 | Out-of-bounds heap read in SM2/SM3 certificate Subject Key Identifier computation | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-55958 | 5.4.0 – 5.9.1 | Renesas TSIP TLS 1.3 transcript buffer out-of-bounds write in tsip_StoreMessage | HIGH 8.3 | 0.4 % | ||
| CVE-2026-55960 | 5.6.4 – 5.9.1 | Un-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validation | HIGH 8.2 | 0.2 % | ||
| CVE-2026-55964 | 5.7.4 – 5.9.1 | Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption) | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-11999 | 5.7.4 – 5.9.1 | X.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert() | HIGH 8.2 | 0.2 % | ||
| CVE-2026-55967 | 4.8.0 – 5.9.1 | AES-GCM streaming APIs do not reject >64 GiB cumulative single messages, enabling counter wrap and keystream reuse | LOW 2.0 | 0.2 % | ||
| CVE-2026-55961 | 3.15.7 – 5.9.1 | wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer | HIGH 8.2 | 0.1 % | ||
| CVE-2026-6091 | 5.7.4 – 5.9.1 | Partial-chain verification accepts untrusted intermediate as trust anchor | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-6291 | 3.9.10 – 5.9.1 | Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-6094 | 5.8.0 – 5.9.1 | Heap buffer overread in wc_PKCS7_DecodeEnvelopedData parsing crafted PKCS7 EnvelopedData | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-5477 | ≤ 5.9.0 | Prefix-substitution forgery via integer overflow in wolfCrypt CMAC | HIGH 8.2 | 0.4 % | ||
| CVE-2026-5188 | ≤ 5.9.0 | Integer underflow in X.509 SAN parsing in wolfSSL | LOW 2.3 | 0.1 % | ||
| CVE-2026-5500 | ≤ 5.9.0 | Improper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication Bypass | HIGH 8.7 | 0.5 % | ||
| CVE-2026-5501 | ≤ 5.9.0 | Improper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates | HIGH 8.6 | 0.3 % | ||
| CVE-2026-5466 | < 5.9.1 | wc_VerifyEccsiHash missing sanity check | HIGH 7.6 | 0.2 % | ||
| CVE-2026-5479 | < 5.9.1 | wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag | HIGH 7.6 | 0.2 % | ||
| CVE-2026-5460 | < 5.9.1 | Heap Use-After-Free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.3 | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-5448 | < 5.9.1 | 1-2 Byte Buffer Overflow in wolfSSL_X509_notAfter/notBefore | LOW 2.3 | 0.3 % | ||
| CVE-2026-5392 | < 5.9.1 | wolfSSL heap OOB read in PKCS7 SignedData streaming | LOW 2.3 | 0.2 % | ||
| CVE-2026-5393 | < 5.9.1 | OOB Read in DoTls13CertificateVerify with WOLFSSL_DUAL_ALG_CERTS | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-5295 | < 5.9.1 | Stack Buffer Overflow in wolfSSL PKCS7 wc_PKCS7_DecryptOri() via Oversized OID | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-5503 | ≤ 5.9.0 | out-of-bounds write in TLSX_EchChangeSNI via attacker-controlled publicName | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-5504 | ≤ 5.9.0 | PKCS7 CBC Padding Oracle — Plaintext Recovery | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-5507 | ≤ 5.9.0 | Session Cache Restore — Arbitrary Free via Deserialized Pointer | MEDIUM 4.1 | 0.2 % | ||
| CVE-2026-5772 | ≤ 5.9.0 | MatchDomainName 1-Byte Stack Buffer Over-Read in Hostname Validation | LOW 2.1 | 0.2 % | ||
| CVE-2026-5778 | ≤ 5.9.0 | Integer underflow leads to out-of-bounds access in sniffer ChaCha decrypt path. | LOW 2.1 | 0.2 % | ||
| CVE-2026-5264 | < 5.9.1 | DTLS 1.3 ACK heap buffer overflow | HIGH 8.3 | 0.4 % | ||
| CVE-2026-5263 | < 5.9.1 | URI nameConstraints not enforced in ConfirmNameConstraints() | HIGH 7.0 | 0.2 % | ||
| CVE-2026-5446 | 5.2.1 – < 5.9.1 | wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-5447 | < 5.9.1 | Heap buffer overflow in CertFromX509() via AuthorityKeyIdentifier | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-5187 | ≤ 5.9.0 | Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL | LOW 2.3 | 0.3 % | ||
| CVE-2026-5194 | 3.12.0 – < 5.9.1 | wolfSSL ECDSA Certificate Verification | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-4159 | < 5.9.0 | wc_PKCS7_DecodeEnvelopedData 1 byte out-of-bounds read | LOW 1.2 | 0.1 % | ||
| CVE-2026-3230 | < 5.9.0 | Improper key_share validation in TLS 1.3 HelloRetryRequest | LOW 1.2 | 0.2 % | ||
| CVE-2026-4395 | ≤ 5.8.4 | Heap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path | LOW 1.3 | 0.4 % | ||
| CVE-2026-3547 | < 5.9.0 | wolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validation | HIGH 7.5 | 0.3 % | ||
| CVE-2026-3580 | < 5.9.0 | Compiler-induced timing leak in sp_256_get_entry_256_9 on RISC-V | LOW 2.1 | 0.1 % | ||
| CVE-2026-3579 | < 5.9.0 | Non-constant time multiplication subroutine __muldi3 on RISC-V RV32I | LOW 2.1 | 0.3 % | ||
| CVE-2026-3548 | < 5.9.0 | Buffer overflow in CRL number parsing in wolfSSL | HIGH 7.2 | 0.5 % | ||
| CVE-2026-2646 | ≤ 5.8.4 | Heap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION() function | MEDIUM 5.0 | 0.1 % | ||
| CVE-2026-2645 | < 5.8.4 | Acceptance of CertificateVerify Message before ClientKeyExchange in TLS 1.2 | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-1005 | ≤ 5.8.4 | Integer underflow leads to out-of-bounds access in sniffer AES-GCM/CCM/ARIA-GCM decrypt path | LOW 2.1 | 0.3 % | ||
| CVE-2026-0819 | 5.5.0 – < 5.9.0 | Stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes | LOW 2.2 | 0.1 % | ||
| CVE-2025-13912 | < 5.8.4 | Potential non-constant time compiled code with Clang LLVM | LOW 1.0 | 0.1 % | ||
| CVE-2025-12889 | < 5.8.4 | TLS 1.2 Client Can Downgrade Digest Used | LOW 2.3 | 0.1 % | ||
| CVE-2025-11932 | < 5.8.4 | Timing Side-Channel in PSK Binder Verification | LOW 2.3 | 0.3 % | ||
| CVE-2025-11931 | < 5.8.4 | Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt | LOW 2.1 | 0.3 % | ||
| CVE-2025-12888 | < 5.8.4 | Constant Time Issue with Xtensa-based ESP32 and X22519 | LOW 1.0 | 0.3 % | ||
| CVE-2025-11936 | 3.12.0 – < 5.8.4 | Potential DoS Vulnerability through Multiple KeyShareEntry with Same Group in TLS 1.3 ClientHello | MEDIUM 6.3 | 0.5 % | ||
| CVE-2025-11934 | 3.12.0 – < 5.8.4 | Improper Validation of Signature Algorithm Used in TLS 1.3 CertificateVerify | LOW 2.1 | 0.2 % | ||
| CVE-2025-11935 | 3.12.0 – < 5.8.4 | Forward Secrecy Violation in WolfSSL TLS 1.3 | MEDIUM 6.3 | 0.2 % | ||
| CVE-2025-7396 | 5.8.0; 0 | Curve25519 Blinding | MEDIUM 5.6 | 0.2 % | ||
| CVE-2025-7394 | 3.15.0 – 5.8.0 | In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for pr | HIGH 7.0 | 0.5 % | ||
| CVE-2025-7395 | 5.6.4 – 5.8.0 | Domain Name Validation Bypass with Apple Native Certificate Validation | CRITICAL 9.2 | 0.3 % | ||
| CVE-2024-1543 | ≤ 5.6.5 | AES T-Table sub-cache-line leakage | MEDIUM 5.5 | 0.2 % | ||
| CVE-2024-1544 | ≤ 5.6.4 | ECDSA nonce bias caused by truncation | MEDIUM 4.9 | 0.3 % | ||
| CVE-2024-5814 | ≤ 5.7.0 | Unverifed Ciphersuite used on a client-side TLS1.3 Downgrade | MEDIUM 5.1 | 0.5 % | ||
| CVE-2024-5991 | ≤ 5.7.0 | Buffer overread in domain name matching | CRITICAL 10.0 | 0.6 % | ||
| CVE-2024-0901 | 3.12.2 – 5.6.6 | SEGV and out of bounds memory read from malicious packet | CRITICAL 9.1 | 0.7 % | ||
| CVE-2023-6936 | ≤ 5.6.5 | Heap-buffer over-read with WOLFSSL_CALLBACKS | CRITICAL 9.1 | 0.6 % | ||
| CVE-2023-6937 | ≤ 5.6.4 | Improper (D)TLS key boundary enforcement | MEDIUM 5.3 | 0.5 % | ||
| CVE-2023-6935 | 3.12.2 – 5.6.4 | Marvin Attack vulnerability in SP Math All RSA | MEDIUM 5.9 | 0.5 % | ||
| CVE-2023-3724 | 3.14.0 – 5.6.0 | TLS 1.3 client issue handling malicious server when not including a KSE and PSK extension | CRITICAL 9.1 | 0.7 % | ||
| CVE-2017-13099 | <3.12.2 | wolfSSL Bleichenbacher/ROBOT | HIGH 7.5 | 27 % | ||
| CVE-2017-2800 | 3.10.2 | A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certif | CRITICAL 9.8 | 8.5 % |