EUVD-2026-39482
GHSA-hvwm-w7rw-23cv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H captures the AT:P oracle-access prerequisite; PR:L from CVSS 4.0 source data; no integrity or availability impact applies.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
2DescriptionCVE.org
Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA PKCS#1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to submit crafted EnvelopedData messages and observe error responses could use this as a padding oracle to incrementally recover the encrypted Content Encryption Key (CEK). The fix generates a deterministic pseudo-random fake CEK on padding failure (via HMAC-SHA256) and proceeds with decryption identically, using constant-time operations throughout, so that all failure paths produce the same error regardless of padding validity.
AnalysisAI
wolfSSL's PKCS#7 EnvelopedData decryption leaks RSA PKCS#1 v1.5 padding validity through distinguishable error codes, enabling a classic Bleichenbacher-style padding oracle attack that allows incremental recovery of the Content Encryption Key (CEK). All wolfSSL versions using PKCS#7 Key Transport Recipient Info (KTRI) with RSA PKCS#1 v1.5 are affected when the decryption interface exposes caller-observable error differentiation. A low-privileged attacker able to submit crafted EnvelopedData messages and observe server error responses can mount an adaptive chosen-ciphertext attack to recover session keys without knowledge of the RSA private key; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
wolfSSL is a lightweight embedded TLS and cryptographic library (CPE: cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*) commonly deployed in IoT, RTOS, and resource-constrained environments. The vulnerability resides in PKCS#7 EnvelopedData processing via the Key Transport Recipient Info (KTRI) mechanism, which uses RSA PKCS#1 v1.5 encryption to wrap the Content Encryption Key. The root cause maps to CWE-208 (Observable Timing Discrepancy / Information Exposure Through Discrepancy): the library returned semantically distinct error codes depending on whether RSA padding validation failed versus whether the decrypted plaintext was structurally malformed - a textbook Bleichenbacher 1998 oracle primitive. The fix, implemented in ssl_p7p12.c, substitutes the distinguishable failure path with a HMAC-SHA256-derived deterministic fake CEK on padding failure and enforces constant-time processing throughout, so all failure paths produce identical observable output regardless of padding validity. The new build-time macro WOLFSSL_NO_KTRI_ORACLE_WARNING (added to .wolfssl_known_macro_extras) provides an explicit opt-out signal.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the fix is accessible via GitHub pull request #10203 at https://github.com/wolfSSL/wolfssl/pull/10203, but a specific tagged release incorporating this change has not been confirmed in the available data. Consult https://www.wolfssl.com/docs/security-vulnerabilities/ for the authoritative fixed release version once published and upgrade as soon as it is available. Until a patched build is deployed, specific compensating controls include: disabling RSA PKCS#1 v1.5 key transport and mandating RSA-OAEP or AES key wrap in PKCS#7 configurations, which eliminates the Bleichenbacher oracle entirely (trade-off: may break interoperability with legacy PKCS#7 senders); restricting access to any API or service that accepts user-supplied PKCS#7 EnvelopedData to trusted, authenticated principals to reduce the oracle's accessibility; and suppressing or normalizing all decryption error responses at the application layer to a single generic error so callers cannot distinguish padding failures from content errors (this is error-prone and should be treated as a temporary measure only, as application-layer normalization can be bypassed by timing differences). The PR diff also introduces the build-time macro WOLFSSL_NO_KTRI_ORACLE_WARNING; review PR #10203 for its precise semantics before relying on it as a mitigation.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today