EUVD-2026-39571
GHSA-r98j-g9p3-fcgm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network delivery requires attacker-controlled PKCS#12 input (AT:P maps to AC:H) and low-privilege access; impact is integrity-only with no confidentiality or availability loss.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
2DescriptionCVE.org
PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted. The PKCS#12 verify path compared the locally computed HMAC against the MAC parsed from the PKCS#12 structure using a length taken directly from the attacker-supplied input, without first verifying that it equals the length of the digest actually produced by the configured algorithm. A truncated or zero-length stored MAC could therefore be accepted, defeating the integrity protection of the MAC.
AnalysisAI
PKCS#12 MAC verification in wolfSSL accepts truncated or zero-length MACs because the comparison uses an attacker-controlled length field parsed from the input structure rather than the expected digest size, completely defeating HMAC integrity protection on PKCS#12 key stores. Any wolfSSL-based application that parses PKCS#12 files from untrusted sources - including certificate import endpoints, VPN provisioning services, or key management systems - can be tricked into accepting a structurally tampered PKCS#12 bundle as MAC-verified. No public exploit code or CISA KEV listing has been identified; the upstream fix is available as GitHub PR #10192 but a tagged patched release has not been independently confirmed.
Technical ContextAI
wolfSSL (cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*) is a lightweight embedded SSL/TLS and cryptographic library targeting IoT, RTOS, and constrained-device environments. PKCS#12 is the binary container format used to bundle private keys, certificates, and CA chains, protected by a MAC (typically HMAC-SHA1 or HMAC-SHA256) and optionally encrypted. The root cause maps to CWE-347 (Improper Verification of Cryptographic Signature): wolfSSL's PKCS#12 verify path invoked an HMAC comparison using a length parameter taken directly from the MAC field as parsed from the attacker-supplied structure, without first asserting that this length equals the output size of the configured digest algorithm. Setting the stored MAC length to zero causes the comparison to operate over zero bytes, trivially succeeding for any input. The PR diff confirms this by adding the test function test_wolfSSL_EVP_DigestVerify_HMAC_zero_len_forgery in tests/api/test_evp_pkey.c, which explicitly asserts that EVP_DigestVerifyFinal must reject a zero-length tag - a check that was absent before the fix.
RemediationAI
Monitor https://www.wolfssl.com/docs/security-vulnerabilities/ and the wolfSSL release notes for an official patched version announcement corresponding to the fix in GitHub PR #10192 (https://github.com/wolfSSL/wolfssl/pull/10192), then upgrade to that version as soon as it is tagged. Note: the patch reference points to an unmerged or recently merged PR - a released patched version number has not been independently confirmed from the available data, so do not treat the PR merge alone as confirmation of availability in a stable release. As a compensating control pending upgrade, restrict or disable PKCS#12 import from untrusted or external sources; this eliminates the attack surface entirely with the trade-off of blocking legitimate external key import workflows. Application-level pre-validation of the MAC length field against expected digest sizes before invoking wolfSSL is an imperfect intermediate measure. Disabling the PKCS#12 feature at compile time (if not required) is the most robust workaround.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today