EUVD-2026-94162
GHSA-cqr9-f685-gr3w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable channel-open abuse with no privileges or user interaction; impact limited to availability (unbounded buffer allocation / DoS), with no confidentiality or integrity effect.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
1DescriptionCVE.org
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.
AnalysisAI
wolfSSH through 1.5.0, when compiled with the --enable-fwd (WOLFSSH_FWD) TCP/IP forwarding option, fails to apply its forwarding policy callback or any channel-count cap to incoming forwarded-tcpip channel opens, so a malicious SSH peer can force unbounded per-channel buffer allocation and exhaust endpoint memory. The same code path leaves wolfSSH clients validating nothing: a forwarded-tcpip open is not checked against the forwards the client actually registered via tcpip-forward, contrary to RFC 4254 section 7.2, and a server should never receive a forwarded-tcpip open at all. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable code path exists only when wolfSSH is compiled with the --enable-fwd (WOLFSSH_FWD) TCP/IP forwarding feature - endpoints built without forwarding support are not affected, which is a significant limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a medium-severity resource-management and authorization flaw (CVSS 4.0 base 6.3), not a critical issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fixes referenced in the advisory data: commits 616eb681e70759c30c3ba158f2b18d7bd954def8 (DoChannelOpen direction check and fail-closed forwarding policy handling in src/internal.c, plus regress.c test), e396a0a4b6b367f10270287446a4be0071742b5c, and 79a7f299337a28aa561409688a268d0efe6e295c (https://github.com/wolfSSL/wolfssh). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
WolfSSH v1.4.7 was discovered to contain an integer overflow via the function wolfSSH_SFTP_RecvRMDIR. Rated critical sev
Improper authentication handling in the wolfSSH key-exchange state machine (versions 1.4.21 and earlier) allows an attac
A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. Rated critical severity (CVSS 9
Host key substitution in wolfSSH clients using ECDSA host keys lets an unauthenticated, network-positioned attacker have
Windows logon token reuse in wolfSSHd versions 1.4.15 through 1.5.0 allows an authenticated low-privilege user to impers
Pre-authentication CPU exhaustion affects wolfSSH servers through 1.5.0 that are built with Diffie-Hellman group-exchang
An authenticated remote attacker with a valid SSH session can trigger a one-byte out-of-bounds stack write in wolfSSH v1
A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote att
Out-of-bounds read in wolfSSHd on Windows allows authenticated users to leak adjacent stack memory via malformed termina
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today