# CVE-2026-8720: wolfSSL HMAC-BLAKE2 message integrity bypass via oversized keys

Source: https://junglewise.ai/threats/cve-2026-8720-wolfssl-hmac-blake2-message-integrity-bypass-via-oversized-keys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-8720 · Severity: info · CVSS 5.9 · Published 2026-06-25

wolfSSL is a security library used to protect data and communications in embedded devices and cloud applications. A flaw in its BLAKE2 hashing component causes the system to ignore the actual message content when a very long security key is used, resulting in a digital signature that does not actually prove the message's integrity. This could allow an attacker to modify data without detection in specific configurations using these newer hashing methods.

Technologies: [Wolfssl](https://junglewise.ai/threats/technologies/wolfssl). Vendors: [Wolfssl](https://junglewise.ai/threats/vendors/wolfssl).

## Quick answers

**Is CVE-2026-8720 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8720 being exploited in the wild.

**How severe is CVE-2026-8720?** Informational severity, with a CVSS score of 5.9, published 25 June 2026.

**Which products and versions are affected?** Wolfssl 5.9.0 to 5.9.1.

**Is there a fix for CVE-2026-8720?** A patch was published on 2026-05-12: Fix merged into master branch via Pull Request 10447 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8720 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-8720?** Check whether you run Wolfssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the HMAC-BLAKE2b and HMAC-BLAKE2s implementations within wolfSSL. When a key longer than the BLAKE2 block size is provided, the functions wc_Blake2bHmacFinal and wc_Blake2sHmacFinal reinitialize the hash state during the key-reduction phase. This reinitialization clobbers the accumulated message data in the running hash state, causing the final MAC to be independent of the input message. An attacker could potentially substitute messages without invalidating the MAC if the application uses oversized keys. The issue was addressed by using a separate hash state for key reduction and ensuring proper zero-padding.

## Affected products

- wolfSSL wolfSSL 5.9.0 to 5.9.1

## Timeline

- 2026-05-12: patched: Fix merged into master branch via Pull Request 10447
- 2026-06-25: disclosed: CVE-2026-8720 published

## References

- [https://github.com/wolfSSL/wolfssl](https://github.com/wolfSSL/wolfssl)
- [https://github.com/wolfSSL/wolfssl/pull/10447](https://github.com/wolfSSL/wolfssl/pull/10447)
- [https://www.wolfssl.com/docs/security-vulnerabilities/](https://www.wolfssl.com/docs/security-vulnerabilities/)

## Related threats

- [wolfSSL certificate validation bypass in ConfirmNameConstraints()](https://junglewise.ai/threats/cve-2026-95208-an-issue-in-the-confirmnameconstraints-function-wolfcrypt-src-asn)
- [wolfSSL revocation check bypass with OCSP and CRL](https://junglewise.ai/threats/cve-2026-94417-when-an-application-enables-both-ocsp-and-crl-revocation-checking)
- [wolfSSL TLS 1.2 ChangeCipherSpec message ordering bypass](https://junglewise.ai/threats/cve-2026-93304-a-d-tls-1-2-client-can-accept-a-changecipherspec-message-before)
- [wolfSSL MatchTrustedPeer public key validation bypass](https://junglewise.ai/threats/cve-2026-93302-matchtrustedpeer-ignores-the-public-key-used-leading-to-forged-ca)
- [wolfSSL TLS authentication bypass in Raw Public Key handling](https://junglewise.ai/threats/cve-2026-89136-when-using-rpk-raw-public-key-the-client-side-of-a-tls-1-2-1-3)