CVE-2025-11934

published 2025-11-21

CVE-2025-11934: Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for…

Priority P4 12 low 2.7 CVSS 3.1

AV N AC L PR H UI N S U C N I L A N

Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for downgrading the signature algorithm used. For example when a client sends ECDSA P521 as the supported signature algorithm the server previously could respond as ECDSA P256 being the accepted signature algorithm and the connection would continue with using ECDSA P256, if the client supports ECDSA P256.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	wolfssl	< wolfssl 5.8.4-1 (forky)	wolfssl 5.8.4-1 (forky)
msrc	azl3_mariadb_10.11.11-1_on_azure_linux_3.0	—	—
msrc	cbl2_mariadb_10.6.21-1_on_cbl_mariner_2.0	—	—
wolfssl	wolfssl	>= 0 < 5.8.4-1	5.8.4-1
wolfssl	wolfssl	>= 3.12.0 < 5.8.4	5.8.4
wolfssl	wolfssl	>= 5.8.2 < 5.8.4	5.8.4

CVSS provenance

nvd v3.1 2.7 LOW CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

nvd v4.0 2.1 LOW CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv 2.1 LOW

vendor_msrc 2.7 LOW

vendor_debian 2.1 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20