| Bug | bullseye | bookworm | trixie | sid | Description |
|---|
| CVE-2026-55967 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | AES-GCM encryption/decryption with extremely large cumulative single m ... |
| CVE-2026-55964 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | Chain intermediate CA:TRUE without keyCertSign accepted as a signing C ... |
| CVE-2026-55962 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | TLS 1.3 post-handshake authentication (PHA) issue where a server could ... |
| CVE-2026-55961 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) ... |
| CVE-2026-55960 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 ... |
| CVE-2026-55958 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In ... |
| CVE-2026-8720 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when t ... |
| CVE-2026-7532 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defi ... |
| CVE-2026-7531 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | Use-after-free in PQC hybrid key-share handling. This is an incomplete ... |
| CVE-2026-7511 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | PKCS7_verify signer confusion allows forged signatures, where the sign ... |
| CVE-2026-6731 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | X.509 name constraint bypass via the Subject Common Name when treated ... |
| CVE-2026-6681 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | The PKCS#7 decode path ignores the caller-supplied output buffer size ... |
| CVE-2026-6679 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | A heap buffer overflow could occur in the DTLS 1.3 ACK serialization p ... |
| CVE-2026-6678 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other R ... |
| CVE-2026-6450 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | A CRL critical extension bypass exists in ParseCRL_Extensions where cr ... |
| CVE-2026-6412 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | Certificate policy and RFC 8446 compliance concerns regarding the cont ... |
| CVE-2026-6331 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-le ... |
| CVE-2026-6330 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | The ML-KEM ARM64 NEON ciphertext comparison only compares half of the ... |
| CVE-2026-6329 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | PKCS#12 MAC verification uses an attacker-controlled comparison length ... |
| CVE-2026-6325 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversiz ... |
| CVE-2026-6291 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypti ... |
| CVE-2026-6094 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing craf ... |
| CVE-2026-6092 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fal ... |
| CVE-2026-6091 | vulnerable | vulnerable | vulnerable (no DSA) | fixed | Partial-chain certificate verification may accept chains that terminat ... |
| CVE-2026-5778 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacke ... |
| CVE-2026-5772 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | A 1-byte stack buffer over-read was identified in the MatchDomainName ... |
| CVE-2026-5507 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | When restoring a session from cache, a pointer from the serialized ses ... |
| CVE-2026-5504 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could a ... |
| CVE-2026-5503 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | In TLSX_EchChangeSNI, the ctx->extensions branch set extensions uncond ... |
| CVE-2026-5501 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | wolfSSL_X509_verify_cert in the OpenSSL compatibility layer accepts a ... |
| CVE-2026-5500 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitiz ... |
| CVE-2026-5479 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in ... |
| CVE-2026-5477 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | An integer overflow existed in the wolfCrypt CMAC implementation, that ... |
| CVE-2026-5466 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r ... |
| CVE-2026-5460 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptog ... |
| CVE-2026-5448 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_not ... |
| CVE-2026-5447 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size c ... |
| CVE-2026-5446 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse ... |
| CVE-2026-5393 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Dual-Algorithm CertificateVerify out-of-bounds read. When processing a ... |
| CVE-2026-5392 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 message can ... |
| CVE-2026-5295 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | A stack buffer overflow exists in wolfSSL's PKCS7 implementation in th ... |
| CVE-2026-5264 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Heap buffer overflow in DTLS 1.3 ACK message processing. A remote atta ... |
| CVE-2026-5263 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | URI nameConstraints from constrained intermediate CAs are parsed but n ... |
| CVE-2026-5194 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Missing hash/digest size and OID checks allow digests smaller than all ... |
| CVE-2026-5188 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | An integer underflow issue exists in wolfSSL when parsing the Subject ... |
| CVE-2026-5187 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Two potential heap out-of-bounds write locations existed in DecodeObje ... |
| CVE-2026-4395 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import ... |
| CVE-2026-4159 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | 1-byte OOB heap read in wc_PKCS7_DecodeEnvelopedData via zero-length e ... |
| CVE-2026-3849 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Confi ... |
| CVE-2026-3580 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | In wolfSSL 5.8.4, constant-time masking logic in sp_256_get_entry_256_ ... |
| CVE-2026-3579 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | wolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time soft ... |
| CVE-2026-3549 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ... |
| CVE-2026-3548 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser ... |
| CVE-2026-3547 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Out-of-bounds read in ALPN parsing due to incomplete validation. wolfS ... |
| CVE-2026-3503 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Protection mechanism failure in wolfCrypt post-quantum implementations ... |
| CVE-2026-3230 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Missing required cryptographic step in the TLS 1.3 client HelloRetryRe ... |
| CVE-2026-3229 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | An integer overflow vulnerability existed in the static function wolfs ... |
| CVE-2026-2646 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_S ... |
| CVE-2026-2645 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 serv ... |
| CVE-2026-1005 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Integer underflow in wolfSSL packet sniffer <= 5.8.4 allows an attacke ... |
| CVE-2026-0819 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | A stack buffer overflow vulnerability exists in wolfSSL's PKCS7 Signed ... |
| CVE-2025-13912 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Multiple constant-time implementations in wolfSSL before version 5.8.4 ... |
| CVE-2025-12889 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | With TLS 1.2 connections a client can use any digest, specifically a w ... |
| CVE-2025-12888 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Vulnerability in X25519 constant-time cryptographic implementations du ... |
| CVE-2025-11936 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolf ... |
| CVE-2025-11935 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could i ... |
| CVE-2025-11934 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Improper input validation in the TLS 1.3 CertificateVerify signature a ... |
| CVE-2025-11933 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Improper Input Validation in the TLS 1.3 CKS extension parsing in wolf ... |
| CVE-2025-11932 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | The server previously verified the TLS 1.3 PSK binder using a non-cons ... |
| CVE-2025-11931 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | vulnerable (no DSA) | fixed | Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 ... |
| CVE-2025-7394 | vulnerable (no DSA, postponed) | fixed | fixed | fixed | In the OpenSSL compatibility layer implementation, the function RAND_p ... |
| CVE-2024-5991 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | In function MatchDomainName(), input param str is treated as a NULL te ... |
| CVE-2024-5814 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | A malicious TLS1.2 server can force a TLS1.3 client with downgrade cap ... |
| CVE-2024-5288 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | An issue was discovered in wolfSSL before 5.7.0. A safe-error attack v ... |
| CVE-2024-2881 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Fault Injection vulnerability inwc_ed25519_sign_msg function in wolfss ... |
| CVE-2024-1545 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Fault Injection vulnerability in RsaPrivateDecryption function in wolf ... |
| CVE-2024-1544 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | Generating the ECDSA nonce k samples a random number r and then trunc ... |
| CVE-2024-1543 | vulnerable (no DSA, postponed) | vulnerable (no DSA) | fixed | fixed | The side-channel protected T-Table implementation in wolfSSL up to ver ... |
| CVE-2024-0901 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | Remotely executed SEGV and out of bounds read allows malicious packet ... |
| CVE-2023-6937 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | wolfSSL prior to 5.6.6 did not check that messages in one (D)TLS recor ... |
| CVE-2023-6936 | vulnerable (no DSA) | vulnerable (no DSA) | fixed | fixed | In wolfSSL prior to 5.6.6, if callback functions are enabled (via the ... |
| CVE-2022-38152 | vulnerable (no DSA) | fixed | fixed | fixed | An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client ... |
| CVE-2022-34293 | vulnerable (no DSA) | fixed | fixed | fixed | wolfSSL before 5.4.0 allows remote attackers to cause a denial of serv ... |
| Bug | Description |
|---|
| TEMP-0000000-2D36D7 | cyassl: RSA Padding check vulnerability |
| CVE-2025-7396 | In wolfSSL release 5.8.2 blinding support is turned on by default for ... |
| CVE-2025-7395 | A certificate verification error in wolfSSL when building with the WOL ... |
| CVE-2023-3724 | If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor ... |
| CVE-2022-42961 | An issue was discovered in wolfSSL before 5.5.0. A fault injection att ... |
| CVE-2022-42905 | In wolfSSL before 5.5.2, if callback functions are enabled (via the WO ... |
| CVE-2022-39173 | In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow ... |
| CVE-2022-38153 | An issue was discovered in wolfSSL before 5.5.0 (when --enable-session ... |
| CVE-2022-25640 | In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a re ... |
| CVE-2022-25638 | In wolfSSL before 5.2.0, certificate validation may be bypassed during ... |
| CVE-2022-23408 | wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situatio ... |
| CVE-2021-44718 | wolfSSL through 5.0.0 allows an attacker to cause a denial of service ... |
| CVE-2021-38597 | wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain si ... |
| CVE-2021-37155 | wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure ou ... |
| CVE-2021-24116 | In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM f ... |
| CVE-2021-3336 | DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not c ... |
| CVE-2020-36177 | RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-o ... |
| CVE-2020-24613 | wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_C ... |
| CVE-2020-24585 | An issue was discovered in the DTLS handshake implementation in wolfSS ... |
| CVE-2020-15309 | An issue was discovered in wolfSSL before 4.5.0, when single precision ... |
| CVE-2020-12457 | An issue was discovered in wolfSSL before 4.5.0. It mishandles the cha ... |
| CVE-2020-11735 | The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use ... |
| CVE-2020-11713 | wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does n ... |
| CVE-2019-19963 | An issue was discovered in wolfSSL before 4.3.0 in a non-default confi ... |
| CVE-2019-19962 | wolfSSL before 4.3.0 mishandles calls to wc_SignatureGenerateHash, lea ... |
| CVE-2019-19960 | In wolfSSL before 4.3.0, wc_ecc_mulmod_ex does not properly resist sid ... |
| CVE-2019-18840 | In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of me ... |
| CVE-2019-16748 | In wolfSSL through 4.1.0, there is a missing sanity check of memory ac ... |
| CVE-2019-15651 | wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCert ... |
| CVE-2019-14317 | wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) gen ... |
| CVE-2019-13628 | wolfSSL and wolfCrypt 4.0.0 and earlier (when configured without --ena ... |
| CVE-2019-11873 | wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when ... |
| CVE-2019-6439 | examples/benchmark/tls_bench.c in a benchmark tool in wolfSSL through ... |
| CVE-2018-16870 | It was found that wolfssl before 3.15.7 is vulnerable to a new variant ... |
| CVE-2018-12436 | wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cac ... |
| CVE-2017-13099 | wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle ... |
| CVE-2017-8855 | wolfSSL before 3.11.0 does not prevent wc_DhAgree from accepting a mal ... |
| CVE-2017-8854 | wolfSSL before 3.10.2 has an out-of-bounds memory access with loading ... |
| CVE-2017-6076 | In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes i ... |
| CVE-2017-2800 | A specially crafted x509 certificate can cause a single out of bounds ... |
| CVE-2016-7440 | The C software implementation of AES Encryption and Decryption in wolf ... |
| CVE-2016-7439 | The C software implementation of RSA in wolfSSL (formerly CyaSSL) befo ... |
| CVE-2016-7438 | The C software implementation of ECC in wolfSSL (formerly CyaSSL) befo ... |
| CVE-2015-7744 | wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults ... |
| CVE-2015-6925 | wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to caus ... |
| CVE-2014-6500 | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, a ... |
| CVE-2014-6496 | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, a ... |
| CVE-2014-6495 | Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, a ... |
| CVE-2014-6494 | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, a ... |
| CVE-2014-6491 | Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier an ... |
| CVE-2014-6478 | Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, a ... |
| CVE-2014-3566 | The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other prod ... |
| CVE-2014-2904 | wolfssl before 3.2.0 has a server certificate that is not properly aut ... |
| CVE-2014-2903 | CyaSSL does not check the key usage extension in leaf certificates, wh ... |
| CVE-2014-2902 | wolfssl before 3.2.0 does not properly authorize CA certificate for si ... |
| CVE-2014-2901 | wolfssl before 3.2.0 does not properly issue certificates for a server ... |