Executive brief
wolfSSL is a cryptographic library used to secure communications for embedded devices and cloud applications. A vulnerability in how it handles encrypted PKCS#7 data could allow an attacker to slowly recover secret encryption keys by observing different error responses from the server. This could lead to the unauthorized decryption of sensitive data protected by the library.
Technical details
A Bleichenbacher padding oracle vulnerability exists in wolfSSL's PKCS#7 KTRI decryption when using RSA PKCS#1 v1.5 key transport. The library returned distinguishable error codes depending on whether RSA padding validation failed or the decrypted content was malformed. An attacker with the ability to submit crafted EnvelopedData messages and observe these error responses can incrementally recover the encrypted Content Encryption Key (CEK). The vulnerability is rooted in an observable discrepancy (CWE-208) during the decryption process. The fix implements constant-time operations and generates a deterministic pseudo-random fake CEK on padding failure to ensure all failure paths produce identical errors.
Affected products
- wolfSSL wolfSSL 3.9.10 through 5.9.1
Timeline
- 2026-04-13: other: Initial pull request for PKCS#7 fixes submitted
- 2026-04-24: patched: Fixes merged into master branch
- 2026-06-25: advisory: CVE-2026-6291 published