Executive brief
wolfSSL is a cryptographic library used to secure network communications in embedded systems and applications. A flaw allows an attacker to complete a TLS handshake by sending an out-of-order message before the client has finished its key exchange, potentially enabling the attacker to inject malicious data the client accepts as legitimate. For connections using pre-shared keys, any attacker can exploit this without possessing the key; for certificate-based connections, the attacker must be positioned between the client and server.
Technical details
A (D)TLS 1.2 client incorrectly accepts a ChangeCipherSpec message before the ClientKeyExchange has been sent, allowing the attacker to derive read keys from known deterministic values and complete the handshake impersonating the server. DTLS clients are vulnerable when a single datagram delivers out-of-order records; TLS clients are vulnerable when the application uses wolfSSL_inject() or enables read-ahead buffering. The attacker cannot decrypt the client's traffic (which uses correct keys), but can send authenticated data, and the legitimate server never completes the handshake. A fix has been merged as of 18 September 2026.
Affected products
- wolfSSL wolfSSL
Timeline
- 2026-09-18: patched: Fix merged in PR #11458