Debian Wolfssl vulnerabilities

CVE-2017-2800 [CRITICAL] CVE-2017-2800: wolfssl - A specially crafted x509 certificate can cause a single out of bounds byte overw... A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution. In order to trigger this vulnerability, the attacker needs to supply a malicious x509 certificate to either a server or a client applicati

CVE-2014-3566 [LOW] CVE-2014-3566: bouncycastle - The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses... The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2019-11873 [CRITICAL] CVE-2019-11873: wolfssl - wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current... wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size. An attacker sends a crafted hello client packet over the network to a TLSv1.3 wolfSSL server. The length fields of the packet: record length, client hello length, total extensions length, PSK extension length, total identity leng

CVE-2026-3849 [MEDIUM] CVE-2026-3849: wolfssl - Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config. A vulne... Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH (Encrypted Client Hello) support, where a maliciously crafted ECH config could cause a stack buffer overflow on the client side, leading to potential remote execution and client program crash. This could be exploited by a malicious TLS server support

CVE-2026-4395 [LOW] CVE-2026-4395: wolfssl - Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex()... Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-controlled data past the bounds of the pubkey_raw buffer via a crafted oversized EC public key point. The WOLFSSL_KCAPI_ECC code path copies the input to key->pubkey_raw (132 bytes) using XMEMCPY without a bounds check, unlike

CVE-2026-3548 [HIGH] CVE-2026-3548: wolfssl - Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsi... Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storing the CRL number as a hexadecimal string, and a stack-based overflow for sufficiently sized CRL numbers. With appropriately crafted CRLs, either of these out of bound writes could be triggered. Note this only af

CVE-2024-2881 [MEDIUM] CVE-2024-2881: wolfssl - Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcry... Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the ed25519_key structure. Scope: local bookworm: open bullseye: open fork

CVE-2024-1545 [MEDIUM] CVE-2024-1545: wolfssl - Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcr... Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the RsaKey structure. Scope: local bookworm: open bullseye: open forky: resol

CVE-2026-3549 [HIGH] CVE-2026-3549: wolfssl - Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extens... Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extension parsing logic when calculating a buffer length, which resulted in writing beyond the bounds of an allocated buffer. Note that in wolfSSL, ECH is off by default, and the ECH standard is still evolving. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 5.9.0-0.1) sid:

CVE-2025-7394 [HIGH] CVE-2025-7394: wolfssl - In the OpenSSL compatibility layer implementation, the function RAND_poll() was ... In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for predictable values returned from RAND_bytes() after fork() is called. This can lead to weak or predictable random numbers generated in applications that are both using RAND_bytes() and doing fork() operations. This only affects appl

CVE-2022-42905 [CRITICAL] CVE-2022-42905: wolfssl - In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALL... In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. (WOLFSSL_CALLBACKS is only intended for debugging.) Scope: local bookworm: resolved (fixed in 5.5.3-1) bullseye: resolved (fixed in 4.6.0+p1-0+deb11u2) forky: resol

CVE-2023-3724 [CRITICAL] CVE-2023-3724: wolfssl - If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key... If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connecting to a malicious server, a default predictable buffer gets used for the IKM (Input Keying Material) value when generating the session master secret. Using a potentially known IKM value when generating the session master secret key compromises the key gen

CVE-2020-36177 [CRITICAL] CVE-2020-36177: wolfssl - RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds w... RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size. Scope: local bookworm: resolved (fixed in 4.6.0-1) bullseye: resolved (fixed in 4.6.0-1) forky: resolved (fixed in 4.6.0-1) sid: resolved (fixed in 4.6.0-1) trixie: resolved (fixed in 4.6.0-1)

CVE-2019-6439 [CRITICAL] CVE-2019-6439: wolfssl - examples/benchmark/tls_bench.c in a benchmark tool in wolfSSL through 3.15.7 has... examples/benchmark/tls_bench.c in a benchmark tool in wolfSSL through 3.15.7 has a heap-based buffer overflow. Scope: local bookworm: resolved (fixed in 4.1.0+dfsg-1) bullseye: resolved (fixed in 4.1.0+dfsg-1) forky: resolved (fixed in 4.1.0+dfsg-1) sid: resolved (fixed in 4.1.0+dfsg-1) trixie: resolved (fixed in 4.1.0+dfsg-1)

CVE-2023-6936 [MEDIUM] CVE-2023-6936: wolfssl - In wolfSSL prior to 5.6.6, if callback functions are enabled (via the WOLFSSL_CA... In wolfSSL prior to 5.6.6, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS client or network attacker can trigger a buffer over-read on the heap of 5 bytes (WOLFSSL_CALLBACKS is only intended for debugging). Scope: local bookworm: open bullseye: open forky: resolved (fixed in 5.6.6-1.2) sid: resolved (fixed in 5.6.6-1.2) trix

CVE-2017-13099 [HIGH] CVE-2017-13099: wolfssl - wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any T... wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as "ROBOT." Scope: local bookworm: resolved (fixed in 3.13.0+dfsg-1) bullseye: resolved (fixed in 3.13.0+dfsg-1) forky: r

CVE-2026-2646 [MEDIUM] CVE-2026-2646: wolfssl - A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION... A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to

CVE-2022-39173 [HIGH] CVE-2022-39173: wolfssl - In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a ... In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list of duplicate cipher suites to trigger the buffer overflow. In total, tw

CVE-2025-11935 [MEDIUM] CVE-2025-11935: wolfssl - With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the ... With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with the connection using PSK without PFS. This happened when a server responded to a ClientHello containing psk_dhe_ke without a key_share extension. The re-use of an authenticated PSK connection that on the cl

CVE-2021-37155 [CRITICAL] CVE-2021-37155: wolfssl - wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when... wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the serial number in the OCSP response. Scope: local bookworm: resolved (fixed in 5.0.0-1) bullseye: resolved (fixed in 4.6.0+p1-0+deb11u1) forky: resolved (fixed in 5.0.0-1) sid: resolved (fixed in 5.0.0-1) trixie: resolved (fixed i