EUVD-2026-39573
GHSA-576m-xh9m-c774
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Adjacent network required; high complexity due to stale-resumption prerequisite; low privileges per input vector; confidentiality-only partial impact from CBC side-channel; no integrity or availability impact.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Lifecycle Timeline
2DescriptionCVE.org
When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC.
AnalysisAI
wolfSSL's TLS 1.2 handshake logic silently downgrades Encrypt-then-MAC (ETM) to MAC-then-Encrypt when a client presents a stale session ID during a failed resumption attempt, affecting all builds compiled with HAVE_ENCRYPT_THEN_MAC using CBC-mode cipher suites. This ETM extension silent-disable (CWE-757) exposes the downgraded connection to CBC-mode side-channel attacks such as Lucky Thirteen, exploitable by an adjacent-network attacker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All of the following conditions must be simultaneously present: (1) wolfSSL compiled with the HAVE_ENCRYPT_THEN_MAC compile-time flag; (2) TLS 1.2 in use - TLS 1.3 is not affected because ETM is not a negotiable extension in TLS 1.3; (3) a CBC-mode cipher suite negotiated between client and server (AEAD suites such as GCM or ChaCha20-Poly1305 are entirely unaffected); (4) the client sends a 32-byte session ID that is absent from the server's session cache, producing a failed resumption - this occurs naturally after server restarts, cache evictions, or load-balanced scenarios where sessions are not shared across nodes; (5) the attacker must be adjacent to the network to intercept and time the downgraded CBC connection for a subsequent Lucky Thirteen attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.1 with vector AV:A/AC:H/AT:P/PR:L/UI:N/VC:L accurately reflects genuinely limited real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An adjacent-network attacker monitors TLS 1.2 connections to a wolfSSL server where a client presents a stale session ID - for example, after a server restart evicted the session cache - triggering the failed-resumption path and silently disabling ETM on the negotiated CBC-mode connection. With MAC-then-Encrypt now active instead of Encrypt-then-MAC, the attacker applies a Lucky Thirteen timing side-channel attack against intercepted ciphertext, using precise packet timing measurements to recover partial plaintext from the session. … |
| Remediation | Upgrade wolfSSL to the release that incorporates PR #10167 (https://github.com/wolfSSL/wolfssl/pull/10167); the exact patched version number is not independently confirmed from available data - consult the wolfSSL security advisories page at https://www.wolfssl.com/docs/security-vulnerabilities/ for the confirmed fixed release tag before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today