Executive brief
wolfSSL is a cryptographic library used to secure communications for embedded devices and cloud applications. A flaw in its OpenSSL-compatibility layer could allow an attacker to bypass security checks by providing an empty or shortened authentication tag during HMAC verification. This could lead to the acceptance of forged data that should have been rejected as untrusted.
Technical details
A vulnerability exists in wolfSSL's OpenSSL-compatibility layer within the EVP_DigestVerifyFinal function. The root cause is improper validation of the supplied signature length during HMAC verification; the code previously only checked that the supplied length did not exceed the maximum MAC length, rather than requiring an exact match. Consequently, a zero-length or truncated tag could be accepted as valid. An attacker could exploit this to forge HMAC tags, bypassing integrity protections. The issue is fixed in version 5.9.1 by enforcing that the supplied tag length exactly matches the expected MAC length and explicitly rejecting zero-length inputs.
Affected products
- wolfSSL wolfSSL 3.15.5 to 5.9.1
Timeline
- 2026-04-15: patched: Fix merged via Pull Request 10192
- 2026-06-25: disclosed: CVE published to NVD