Is CVE-2026-5479 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5479 being exploited in the wild.

How severe is CVE-2026-5479?

High severity, with a CVSS score of 8.1, published 10 April 2026.

Which products and versions are affected?

wolfSSL wolfSSL versions up to (excluding) 5.9.1.

Is there a fix for CVE-2026-5479?

A patch was published on 2026-04-06: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5479 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-5479?

Check whether you run Wolfssl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5479: wolfSSL improper authentication tag validation in ChaCha20-Poly1305 decryption

CVE-2026-5479 · Severity: high · CVSS 8.1 · Published 2026-04-10

wolfSSL is a security library used by applications to encrypt and protect data. A flaw in its decryption process allows it to accept modified or forged data without realizing it has been tampered with. This could allow an attacker to bypass security checks, potentially leading to the exposure of sensitive information or the acceptance of malicious commands.

Technologies: Wolfssl. Vendors: Wolfssl.

Quick answers

Is CVE-2026-5479 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5479 being exploited in the wild.
How severe is CVE-2026-5479?: High severity, with a CVSS score of 8.1, published 10 April 2026.
Which products and versions are affected?: wolfSSL wolfSSL versions up to (excluding) 5.9.1.
Is there a fix for CVE-2026-5479?: A patch was published on 2026-04-06: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5479 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-5479?: Check whether you run Wolfssl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in wolfSSL's EVP layer specifically within the ChaCha20-Poly1305 AEAD decryption path. The function wolfSSL_EVP_CipherFinal (and related finalization functions) fails to compare the computed authentication tag against the expected tag provided by the sender. This improper validation of the integrity check value (CWE-354) means that the library returns plaintext to the calling application even if the ciphertext has been modified. An attacker with adjacent network access could exploit this to inject malicious data or bypass integrity protections. The issue is addressed in wolfSSL version 5.9.1.

Affected products

wolfSSL wolfSSL versions up to (excluding) 5.9.1

Timeline

2026-03-30: other: Fix submitted via pull request 10102
2026-04-06: patched: Fix merged into master branch
2026-04-10: disclosed: CVE-2026-5479 published

References

https://github.com/wolfSSL/wolfssl/pull/10102

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.