Quick answers
- Is CVE-2026-81535 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81535 being exploited in the wild.
- How severe is CVE-2026-81535?
- Informational severity, published 7 October 2026.
- Which products and versions are affected?
- Wolfssl wolfSSH through 1.5.0 when built with --enable-fwd.
- Is there a fix for CVE-2026-81535?
- No fixed version is recorded yet. Disable SSH port forwarding by not building wolfSSH with the --enable-fwd option, or restrict SSH connections to trusted peers only until an upgrade is applied. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-81535 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-81535?
- Check whether you run Wolfssl wolfSSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Disable SSH port forwarding by not building wolfSSH with the --enable-fwd option, or restrict SSH connections to trusted peers only until an upgrade is applied.
Technical details
When --enable-fwd is used, the DoChannelOpen() function in src/internal.c gates direct-tcpip channel opens with a forwarding policy callback but fails to check forwarded-tcpip opens, allowing them through without authorization. This also violates RFC 4254 section 7.2, which requires clients to validate forwarded-tcpip opens against registered forwards. An attacker (malicious SSH peer or server) can exploit this to allocate unbounded per-channel buffers or open forwarding channels for unauthorized addresses and ports.
Affected products
- wolfSSL wolfSSH through 1.5.0 when built with --enable-fwd
Timeline
- 2026-10-07: disclosed