# CVE-2026-16516: wolfSSH ECDSA curve substitution in host key parsing

Source: https://junglewise.ai/threats/cve-2026-16516-wolfssh-does-not-validate-that-the-ecdsa-curve-identifier-in-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-16516 · Severity: info · Published 2026-10-07

wolfSSH is an SSH library used in embedded systems and applications to handle secure shell communications. A man-in-the-middle attacker can substitute a different ECDSA curve in the host key during SSH key exchange, potentially bypassing public key validation if the application uses weak validation (such as trust-on-first-use or algorithm-name-only checks). This could allow an attacker to spoof the server and intercept communications.

Technologies: [Wolfssl wolfSSH](https://junglewise.ai/threats/technologies/wolfssl-wolfssh). Vendors: [Wolfssl](https://junglewise.ai/threats/vendors/wolfssl).

## Quick answers

**Is CVE-2026-16516 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16516 being exploited in the wild.

**How severe is CVE-2026-16516?** Informational severity, published 7 October 2026.

**Which products and versions are affected?** wolfSSL wolfSSH.

**Is there a fix for CVE-2026-16516?** A patch was published on 2026-06-15: Fix committed before disclosure date; likely version not yet released at disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16516 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16516?** Check whether you run Wolfssl wolfSSH. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cryptographic validation bypass (CWE-345) in ParseECCPubKey() in src/internal.c. During KEXDH_REPLY processing, the function derives the ECDSA curve from the key blob's algorithm string without validating it against the negotiated ssh->handshake->pubKeyId, and skips reading the RFC 5656 curve identifier instead of comparing it. An active MitM attacker can send a host key with a substituted curve (e.g., nistp384 instead of negotiated nistp256), which wolfSSH accepts. Exploitation requires both network-level MitM capability and a lax public key validation callback; the attacker controls the substituted key's private key so signatures still verify.

## Affected products

- wolfSSL wolfSSH

## Timeline

- 2026-10-07: disclosed
- 2026-06-15: patched: Fix committed before disclosure date; likely version not yet released at disclosure

## References

- [https://github.com/wolfSSL/wolfssh/commit/31d13697a608fa1bf9eec11aa6eff1503ade836f](https://github.com/wolfSSL/wolfssh/commit/31d13697a608fa1bf9eec11aa6eff1503ade836f)
- [https://github.com/wolfSSL/wolfssh/issues/1012](https://github.com/wolfSSL/wolfssh/issues/1012)

## Related threats

- [wolfSSL wolfSSH Diffie-Hellman group exchange message handling bypass](https://junglewise.ai/threats/cve-2026-84897-src-internal-c-in-wolfssl-wolfssh-through-1-5-0-admits-the-server)
- [wolfSSL wolfSSH unsigned integer underflow in wstrncat()](https://junglewise.ai/threats/cve-2026-83742-unsigned-integer-underflow-in-wstrncat-in-src-port-c-in-wolfssl)
- [wolfSSL wolfSSHd Windows logon token release-of-resource vulnerability](https://junglewise.ai/threats/cve-2026-83540-when-password-or-public-key-authentication-is-used-with-the)
- [wolfSSH forwarded-tcpip channel authorization bypass](https://junglewise.ai/threats/cve-2026-81535-in-wolfssh-through-1-5-0-built-with-enable-fwd-dochannelopen-in)