EUVD-2026-21220
GHSA-2jvp-h4w4-2vxh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in the AEAD decryption path by injecting a TLS record shorter than the explicit IV plus authentication tag into traffic inspected by ssl_DecodePacket. The underflow wraps a 16-bit length to a large value that is passed to AEAD decryption routines, causing a large out-of-bounds read and crash. An unauthenticated attacker can trigger this remotely via malformed TLS Application Data records.
AnalysisAI
Integer underflow in wolfSSL's packet sniffer (versions up to 5.9.0) allows remote attackers to crash applications during AEAD decryption by sending malformed TLS Application Data records with insufficient length for the explicit IV and authentication tag. The vulnerability wraps a 16-bit length value to an unexpectedly large integer, triggering an out-of-bounds read in decryption routines. While the CVSS score is low (2.1) due to limited practical impact (availability only), the attack requires no victim interaction beyond network exposure and affects any system passively inspecting encrypted TLS traffic through wolfSSL's ssl_DecodePacket function.
Technical ContextAI
The vulnerability resides in wolfSSL's TLS packet inspection functionality, specifically in the AEAD (Authenticated Encryption with Associated Data) decryption path invoked by ssl_DecodePacket. AEAD modes (such as AES-GCM and ChaCha20-Poly1305) require sufficient data to extract an explicit initialization vector (IV) and an authentication tag (typically 12-16 bytes combined). The integer underflow occurs when packet sniffer code calculates the remaining plaintext length after subtracting the IV and tag sizes from a 16-bit TLS record length field. If the TLS record is artificially shortened (e.g., shorter than the combined IV and tag length), the unsigned integer arithmetic wraps around to a very large value due to underflow. This wrapped value is then passed to AEAD decryption routines expecting legitimate plaintext length, causing the routines to attempt reading far beyond allocated buffer boundaries. CWE-191 (Integer Underflow) is the root cause classification. The attack vector is network-based and affects passive TLS inspection use cases where wolfSSL processes potentially adversarial encrypted traffic.
RemediationAI
Apply the upstream fix available in wolfSSL GitHub pull request #10125 or upgrade to a patched release version once officially published by the wolfSSL project. Until patched versions are available, mitigate by restricting network exposure of systems performing TLS packet inspection (e.g., deploy packet sniffers only on trusted internal networks or behind access controls). Organizations should monitor the wolfSSL project repository and security advisories for the next official release incorporating this fix. For systems where TLS inspection is not required, disable or remove wolfSSL packet sniffing functionality. Verify patch application by confirming ssl_DecodePacket correctly handles undersized AEAD records without integer underflow.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same weakness CWE-191 – Integer Underflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today