Executive brief
wolfSSL is a security library used to provide encrypted communications for embedded devices and cloud applications. A technical flaw in how the library handles lists of digital signature algorithms could allow a local attacker to cause a memory error. While the risk is low, this could potentially lead to a service crash or limited unauthorized memory modification during the secure connection process.
Technical details
An out-of-bounds write vulnerability exists in the `SetSuitesHashSigAlgo` function within `src/internal.c`. The issue stems from a lack of preflight bounds checking when parsing user-provided signature algorithm lists, specifically when handling RSA-PSS in TLS 1.3 which adds multiple entries to the list. An attacker providing a specially crafted, oversized list can trigger a write past the destination buffer's boundaries. This vulnerability requires the application to be configured with specific options like `--enable-opensslextra` and involves local interaction. A fix was introduced in the wolfSSL master branch to add explicit bounds checks before calling `AddSuiteHashSigAlgo`.
Affected products
- wolfSSL wolfSSL 4.8.0 to 5.9.1
Timeline
- 2026-04-13: other: Pull request submitted to wolfSSL repository
- 2026-04-15: patched: Fix merged into master branch
- 2026-06-25: advisory: NVD publication date