EUVD-2026-39573
GHSA-576m-xh9m-c774
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Adjacent network required; high complexity due to stale-resumption prerequisite; low privileges per input vector; confidentiality-only partial impact from CBC side-channel; no integrity or availability impact.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
2DescriptionCVE.org
When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC.
AnalysisAI
wolfSSL's TLS 1.2 handshake logic silently downgrades Encrypt-then-MAC (ETM) to MAC-then-Encrypt when a client presents a stale session ID during a failed resumption attempt, affecting all builds compiled with HAVE_ENCRYPT_THEN_MAC using CBC-mode cipher suites. This ETM extension silent-disable (CWE-757) exposes the downgraded connection to CBC-mode side-channel attacks such as Lucky Thirteen, exploitable by an adjacent-network attacker. No public exploit identified at time of analysis and no confirmed active exploitation; vendor patch is available upstream via PR #10167.
Technical ContextAI
wolfSSL is a lightweight embedded TLS/SSL library written in C, widely used in IoT and resource-constrained devices. RFC 7366 defines Encrypt-then-MAC as a TLS extension that reverses the default MAC-then-Encrypt order in CBC cipher suites, mitigating the Lucky Thirteen class of timing side-channel attacks. The root cause (CWE-757: Selection of Less-Secure Algorithm During Negotiation) lies in src/internal.c: when a client sends a 32-byte session ID the server's DoClientHello parser sets ssl->options.resuming=1, but if HandleTlsResumption fails to find the session in the cache, resuming is cleared and ssl->specs.cipher_type remains zero-initialized (equivalent to 'stream', not 'block'). The original ETM decision block ran before MatchSuite and SetCipherSpecs could populate cipher_type, so the block-cipher guard evaluated false, clearing ssl->options.encThenMac to 0. Because the post-MatchSuite path only extends ETM, not re-enables it, the connection silently negotiated MAC-then-Encrypt for the rest of the session. The fix gates the ETM decision on ssl->options.resuming being confirmed true after HandleTlsResumption succeeds, ensuring cipher_type is valid before the check. Affected CPE: cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:* with HAVE_ENCRYPT_THEN_MAC enabled.
RemediationAI
Upgrade wolfSSL to the release that incorporates PR #10167 (https://github.com/wolfSSL/wolfssl/pull/10167); the exact patched version number is not independently confirmed from available data - consult the wolfSSL security advisories page at https://www.wolfssl.com/docs/security-vulnerabilities/ for the confirmed fixed release tag before deploying. As an immediate compensating control pending upgrade, restrict cipher suite configuration to AEAD-only suites (e.g., TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256) via wolfSSL's cipher list API; since ETM applies only to CBC block ciphers, removing CBC suites entirely eliminates the vulnerable negotiation path - the trade-off is potential incompatibility with legacy TLS 1.2 clients that lack AEAD support. Alternatively, enforcing TLS 1.3 exclusively removes the affected code path at the protocol level, with the trade-off of dropping TLS 1.2 client compatibility. Disabling session ID-based resumption (using ticket-only resumption or disabling session cache) may also prevent the stale-resumption trigger condition, though this is a narrower mitigation and does not remove the underlying code defect.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today