Executive brief
A security flaw was identified in the wolfSSL cryptographic library, which is used to secure communications for various applications and devices. An attacker positioned between two communicating parties could manipulate encrypted messages to bypass security checks, potentially allowing them to alter data without being detected. This could lead to a loss of data integrity in systems relying on wolfSSL for secure data transmission.
Technical details
The vulnerability exists within the 'wc_PKCS7_DecodeAuthEnvelopedData()' function in wolfSSL. The component fails to perform a lower bounds check or proper sanitization on the received AES-GCM authentication tag length. A man-in-the-middle (MitM) attacker can exploit this by truncating the MAC field from the standard 16 bytes down to as little as 1 byte. This reduces the complexity of the authentication tag check from 2^-128 to 2^-8, making it computationally feasible to forge or modify encrypted content. The issue is addressed in wolfSSL version 5.9.1.
Affected products
- wolfSSL wolfSSL up to and including 5.9.0
Timeline
- 2026-03-30: patched: Fix submitted via pull request 10102
- 2026-04-10: disclosed: Initial CVE publication
- 2026-04-27: advisory: NIST initial analysis completed