WwolfSSL Inc.

Products

Exploited and recent CVEs

• CVE-2026-84897 Medium 6.9 wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion 0.5%
• CVE-2026-83742 Medium 5.3 wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms 0.4%
• CVE-2026-81535 Medium 6.3 wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check 0.3%
• CVE-2026-16516 Critical 9.0 wolfSSH ECDSA host key curve not validated against negotiated algorithm 0.2%
• CVE-2026-81341 Medium 6.5 wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records 0.3%
• CVE-2026-81020 High 7.4 wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record 0.4%
• CVE-2026-81019 High 7.4 wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record 0.4%
• CVE-2026-3849 Medium 6.9 Buffer Overflow in HPKE via Oversized ECH Config 0.5%
• CVE-2026-3503 Medium 4.3 Fault injection attack with ML-DSA and ML-KEM on ARM 0.2%
• CVE-2025-7844 Low 1.0 wolfTPM library wrapper function `wolfTPM2_RsaKey_TpmToWolf` copies external data to a fixed-size stack buffer without length validation potentially causing stack-based buffer overflow 0.2%
• CVE-2024-5288 Medium 5.1 Safe-error attack on TLS 1.3 Protocol 0.4%
• CVE-2024-2873 Critical 9.1 User authentication bypass in wolfSSH server 0.6%