Executive brief
wolfSSL is a security library used to protect communications for embedded devices and cloud services. A flaw in how it handles secure connections could allow the system to use a less secure encryption method than intended when a previous session fails to resume correctly. While this reduces the overall strength of the security, it does not directly expose data to an attacker without other significant conditions being met.
Technical details
A vulnerability exists in wolfSSL versions 5.2.0 through 5.9.1 where the TLS 1.2 implementation fails to enforce the Encrypt-then-MAC (EtM) extension during specific handshake paths. Specifically, if a server initially attempts to resume a session but the resumption lookup fails (e.g., due to a stale session ID), the logic in DoClientHello may silently disable EtM and fall back to the older MAC-then-Encrypt (MtE) mechanism. This is classified as a 'Selection of Less-Secure Algorithm During Negotiation' (CWE-757). An attacker with adjacent network access and specific preconditions could potentially exploit this downgrade, though the impact is limited to a loss of cryptographic strength. The issue is fixed in wolfSSL version 5.9.1.
Affected products
- wolfSSL wolfSSL 5.2.0 through 5.9.1
Timeline
- 2026-04-09: patched: Fix merged into wolfSSL master branch via PR 10167
- 2026-06-25: disclosed: CVE-2026-6092 published