CVE-2026-84897: wolfSSL wolfSSH Diffie-Hellman group exchange message handling bypass

CVE-2026-84897 · Severity: info · Published 2026-10-07

wolfSSL wolfSSH is an SSH library used in embedded systems and applications. A flaw in message validation allows an unauthenticated attacker to send server-side key exchange messages to a server, causing it to process them as if they came from the client. This forces the server to perform expensive primality validation on attacker-controlled cryptographic parameters, enabling denial-of-service attacks on SSH servers using this library.

Technologies: Wolfssl wolfSSH. Vendors: Wolfssl.

Quick answers

Is CVE-2026-84897 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84897 being exploited in the wild.
How severe is CVE-2026-84897?
Informational severity, published 7 October 2026.
Which products and versions are affected?
Wolfssl wolfSSH through 1.5.0.
Is there a fix for CVE-2026-84897?
No fixed version is recorded yet. Disable Diffie-Hellman group exchange support by defining WOLFSSH_NO_DH_GEX_SHA256 at compile time. Builds that define WOLFSSH_NO_DH or NO_SHA256 are unaffected. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84897 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84897?
Check whether you run Wolfssl wolfSSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable Diffie-Hellman group exchange support by defining WOLFSSH_NO_DH_GEX_SHA256 at compile time. Builds that define WOLFSSH_NO_DH or NO_SHA256 are unaffected.

Technical details

The IsMessageAllowedServer() function in src/internal.c fails to enforce directional checks on SSH key exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_REPLY (33) during the Diffie-Hellman group exchange negotiation. An unauthenticated client can send these server-to-client messages before authentication; the server incorrectly invokes the client-side handler DoKexDhGexGroup(), which validates the attacker-supplied prime using two 8-round Miller-Rabin tests on values up to 8192 bits. This allows a remote attacker to cause high CPU consumption and deny service.

Affected products

  • wolfSSL wolfSSH through 1.5.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.