wolfSSL EUVD-2026-39573

All of the following conditions must be simultaneously present: (1) wolfSSL compiled with the HAVE_ENCRYPT_THEN_MAC compile-time flag; (2) TLS 1.2 in use - TLS 1.3 is not affected because ETM is not a negotiable extension in TLS 1.3; (3) a CBC-mode cipher suite negotiated between client and server (AEAD suites such as GCM or ChaCha20-Poly1305 are entirely unaffected); (4) the client sends a 32-byte session ID that is absent from the server's session cache, producing a failed resumption - this occurs naturally after server restarts, cache evictions, or load-balanced scenarios where sessions are not shared across nodes; (5) the attacker must be adjacent to the network to intercept and time the downgraded CBC connection for a subsequent Lucky Thirteen attack. The ETM downgrade is a passive race condition in the server's ClientHello parsing logic and does not require attacker-controlled network input to trigger; the stale session ID is client-generated. Per the CVSS 4.0 vector (PR:L), some level of access is indicated, though the exact authentication boundary is not further specified in the available description.

The CVSS 4.0 score of 2.1 with vector AV:A/AC:H/AT:P/PR:L/UI:N/VC:L accurately reflects genuinely limited real-world risk. Adjacent network attack vector (AV:A) means the attacker must be co-located on the same local segment - Internet-scale exploitation is not possible. High attack complexity (AC:H) and the prerequisite of a stale session ID (AT:P) add further barriers: the triggering condition requires a client to offer a session ID absent from the server's cache, which an attacker cannot reliably force without controlling client behavior. Confidentiality impact is Low (VC:L), consistent with partial plaintext recovery via Lucky Thirteen timing analysis rather than full session compromise. No active exploitation is confirmed - this CVE is not in CISA KEV - and no public PoC was identified at time of analysis; EPSS data was not provided in the input. The signal set consistently points to a real but low-probability, low-impact cryptographic downgrade. However, for wolfSSL deployments in sensitive adjacent-network contexts (embedded systems, IoT protocols, industrial control) where TLS 1.2 CBC suites are negotiated and HAVE_ENCRYPT_THEN_MAC is compiled in, patching is still warranted because the protection ETM provides is specifically designed for those CBC-mode environments.

An adjacent-network attacker monitors TLS 1.2 connections to a wolfSSL server where a client presents a stale session ID - for example, after a server restart evicted the session cache - triggering the failed-resumption path and silently disabling ETM on the negotiated CBC-mode connection. With MAC-then-Encrypt now active instead of Encrypt-then-MAC, the attacker applies a Lucky Thirteen timing side-channel attack against intercepted ciphertext, using precise packet timing measurements to recover partial plaintext from the session. No public exploit code was identified at time of analysis; this attack class requires significant measurement precision and adjacent-network positioning.