# Wolfssl vulnerabilities

Source: https://junglewise.ai/threats/vendors/wolfssl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/wolfssl.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 72 vulnerabilities in Wolfssl: 0 in the last 7 days and 20 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-95208, was published on 8 October 2026. Nothing in the last four weeks, down from 17 vulnerabilities in the four before. 2 technologies have a page of their own.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 20
- All time: 72 (2 critical, 0 exploited in the wild)

## About Wolfssl

wolfSSL is a software company that develops embedded security solutions, including the wolfSSL SSL/TLS library.

## Latest Wolfssl vulnerabilities

- [CVE-2026-95208: wolfSSL certificate validation bypass in ConfirmNameConstraints()](https://junglewise.ai/threats/cve-2026-95208-an-issue-in-the-confirmnameconstraints-function-wolfcrypt-src-asn) (high, CVSS 7.5, published 8 Oct 2026)
- [CVE-2026-84897: wolfSSL wolfSSH Diffie-Hellman group exchange message handling bypass](https://junglewise.ai/threats/cve-2026-84897-src-internal-c-in-wolfssl-wolfssh-through-1-5-0-admits-the-server) (info, published 7 Oct 2026)
- [CVE-2026-83742: wolfSSL wolfSSH unsigned integer underflow in wstrncat()](https://junglewise.ai/threats/cve-2026-83742-unsigned-integer-underflow-in-wstrncat-in-src-port-c-in-wolfssl) (info, published 7 Oct 2026)
- [CVE-2026-83540: wolfSSL wolfSSHd Windows logon token release-of-resource vulnerability](https://junglewise.ai/threats/cve-2026-83540-when-password-or-public-key-authentication-is-used-with-the) (info, published 7 Oct 2026)
- [CVE-2026-81535: wolfSSH forwarded-tcpip channel authorization bypass](https://junglewise.ai/threats/cve-2026-81535-in-wolfssh-through-1-5-0-built-with-enable-fwd-dochannelopen-in) (info, published 7 Oct 2026)
- [CVE-2026-16516: wolfSSH ECDSA curve substitution in host key parsing](https://junglewise.ai/threats/cve-2026-16516-wolfssh-does-not-validate-that-the-ecdsa-curve-identifier-in-a) (info, published 7 Oct 2026)
- [CVE-2026-94417: wolfSSL revocation check bypass with OCSP and CRL](https://junglewise.ai/threats/cve-2026-94417-when-an-application-enables-both-ocsp-and-crl-revocation-checking) (info, published 27 Sep 2026)
- [CVE-2026-93304: wolfSSL TLS 1.2 ChangeCipherSpec message ordering bypass](https://junglewise.ai/threats/cve-2026-93304-a-d-tls-1-2-client-can-accept-a-changecipherspec-message-before) (info, published 27 Sep 2026)
- [CVE-2026-93302: wolfSSL MatchTrustedPeer public key validation bypass](https://junglewise.ai/threats/cve-2026-93302-matchtrustedpeer-ignores-the-public-key-used-leading-to-forged-ca) (info, published 27 Sep 2026)
- [CVE-2026-89136: wolfSSL TLS authentication bypass in Raw Public Key handling](https://junglewise.ai/threats/cve-2026-89136-when-using-rpk-raw-public-key-the-client-side-of-a-tls-1-2-1-3) (info, published 27 Sep 2026)
- [CVE-2026-89135: wolfSSL X509_verify_cert certificate validation bypass in CertManager](https://junglewise.ai/threats/cve-2026-89135-a-failed-x509-verify-cert-call-permanently-plants-an-unverified) (info, published 27 Sep 2026)
- [CVE-2026-89134: wolfSSL certificate name-constraint bypass via SAN mismatch](https://junglewise.ai/threats/cve-2026-89134-a-certificate-with-no-dnsname-san-but-another-san-type-present-e) (info, published 27 Sep 2026)
- [CVE-2026-89133: wolfSSL X.509 certificate validation bypass in NameConstraints](https://junglewise.ai/threats/cve-2026-89133-wolfssl-versions-5-9-2-and-earlier-contain-a-flaw-in-the-x-509) (info, published 27 Sep 2026)
- [CVE-2026-89102: wolfSSL certificate forgery in OCSP response stapling](https://junglewise.ai/threats/cve-2026-89102-in-wolfssl-versions-5-7-2-through-5-9-2-there-is-a-client-side) (info, published 27 Sep 2026)
- [CVE-2026-15442: wolfSSL heap-use-after-free in TLS shutdown](https://junglewise.ai/threats/cve-2026-15442-in-all-builds-that-make-use-of-d-tls-including-default-builds) (info, published 27 Sep 2026)
- [CVE-2026-94419: wolfSSL session cache poisoning in TLS 1.2 resumption](https://junglewise.ai/threats/cve-2026-94419-without-no-session-cache-ref-wolfssl-get-session-does-not-return) (info, published 27 Sep 2026)
- [CVE-2026-94418: WolfSSL certificate signature verification bypass under WOLFSSL_SMALL_CERT_VERIFY](https://junglewise.ai/threats/cve-2026-94418-under-wolfssl-small-cert-verify-processpeercertparse-runs-the) (info, published 27 Sep 2026)
- [CVE-2026-81341: wolfSSL wolfEngine AES-CCM nonce reuse in TLS 1.2 and DTLS 1.2](https://junglewise.ai/threats/cve-2026-81341-wolfssl-wolfengine-aes-ccm-nonce-reuse-in-tls-1-2-and-dtls-1-2) (medium, CVSS 6.5, published 28 Aug 2026)
- [CVE-2026-81020: wolfSSL wolfEngine AES-GCM nonce reuse in TLS 1.2 and DTLS 1.2](https://junglewise.ai/threats/cve-2026-81020-wolfssl-wolfengine-aes-gcm-nonce-reuse-in-tls-1-2-and-dtls-1-2) (high, CVSS 7.4, published 28 Aug 2026)
- [CVE-2026-81019: wolfSSL wolfProvider AES-GCM nonce reuse in TLS 1.2/DTLS 1.2](https://junglewise.ai/threats/cve-2026-81019-wolfssl-wolfprovider-aes-gcm-nonce-reuse-in-tls-1-2-dtls-1-2) (high, CVSS 7.4, published 28 Aug 2026)
- [CVE-2026-8720: wolfSSL HMAC-BLAKE2 message integrity bypass via oversized keys](https://junglewise.ai/threats/cve-2026-8720-wolfssl-hmac-blake2-message-integrity-bypass-via-oversized-keys) (info, CVSS 5.9, published 25 Jun 2026)
- [CVE-2026-7532: wolfSSL IP address name constraints bypass when WOLFSSL_IP_ALT_NAME is undefined](https://junglewise.ai/threats/cve-2026-7532-wolfssl-ip-address-name-constraints-bypass-when-wolfssl-ip-alt) (info, CVSS 5.7, published 25 Jun 2026)
- [CVE-2026-7511: wolfSSL improper signature verification in PKCS7_verify](https://junglewise.ai/threats/cve-2026-7511-wolfssl-improper-signature-verification-in-pkcs7-verify) (info, CVSS 5.9, published 25 Jun 2026)
- [CVE-2026-6331: wolfSSL HMAC zero-length tag forgery in EVP_DigestVerifyFinal](https://junglewise.ai/threats/cve-2026-6331-wolfssl-hmac-zero-length-tag-forgery-in-evp-digestverifyfinal) (info, CVSS 2.1, published 25 Jun 2026)
- [CVE-2026-6330: wolfSSL ML-KEM partial ciphertext comparison on ARM64 NEON](https://junglewise.ai/threats/cve-2026-6330-wolfssl-ml-kem-partial-ciphertext-comparison-on-arm64-neon) (info, CVSS 6.3, published 25 Jun 2026)

## Most severe Wolfssl vulnerabilities

- [CVE-2026-5194: wolfSSL improper certificate validation in ECDSA signature verification](https://junglewise.ai/threats/cve-2026-5194-wolfssl-improper-certificate-validation-in-ecdsa-signature) (critical, CVSS 9.1, published 9 Apr 2026)
- [CVE-2026-5393: wolfSSL out-of-bounds read in dual-algorithm CertificateVerify processing](https://junglewise.ai/threats/cve-2026-5393-wolfssl-out-of-bounds-read-in-dual-algorithm-certificateverify) (critical, CVSS 9.1, published 10 Apr 2026)
- [CVE-2025-11931: Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a…](https://junglewise.ai/threats/cve-2025-11931-integer-underflow-leads-to-out-of-bounds-access-in-xchacha20) (high, CVSS 8.2, published 21 Nov 2025)
- [CVE-2026-5501: wolfSSL improper certificate validation in OpenSSL compatibility layer](https://junglewise.ai/threats/cve-2026-5501-wolfssl-improper-certificate-validation-in-openssl-compatibility) (high, CVSS 8.1, published 10 Apr 2026)
- [CVE-2026-5479: wolfSSL improper authentication tag validation in ChaCha20-Poly1305 decryption](https://junglewise.ai/threats/cve-2026-5479-wolfssl-improper-authentication-tag-validation-in-chacha20) (high, CVSS 8.1, published 10 Apr 2026)
- [CVE-2026-5466: wolfSSL improper signature verification in ECCSI wc_VerifyEccsiHash](https://junglewise.ai/threats/cve-2026-5466-wolfssl-improper-signature-verification-in-eccsi-wc) (high, CVSS 8.1, published 10 Apr 2026)
- [CVE-2026-5188: wolfSSL integer underflow in X.509 SAN extension parsing](https://junglewise.ai/threats/cve-2026-5188-wolfssl-integer-underflow-in-x-509-san-extension-parsing) (high, CVSS 8.1, published 10 Apr 2026)
- [CVE-2025-12888: Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler…](https://junglewise.ai/threats/cve-2025-12888-vulnerability-in-x25519-constant-time-cryptographic) (high, CVSS 7.5, published 21 Nov 2025)
- [CVE-2025-11935: With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward…](https://junglewise.ai/threats/cve-2025-11935-with-tls-1-3-pre-shared-key-psk-a-malicious-or-faulty-server) (high, CVSS 7.5, published 21 Nov 2025)
- [CVE-2026-95208: wolfSSL certificate validation bypass in ConfirmNameConstraints()](https://junglewise.ai/threats/cve-2026-95208-an-issue-in-the-confirmnameconstraints-function-wolfcrypt-src-asn) (high, CVSS 7.5, published 8 Oct 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 17 vulnerabilities in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 3 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 11 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 6 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Wolfssl technologies

- [wolfSSL](https://junglewise.ai/threats/technologies/wolfssl): 64 vulnerabilities
- [Wolfssl wolfSSH](https://junglewise.ai/threats/technologies/wolfssl-wolfssh): 5 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wolfssl vulnerabilities", https://junglewise.ai/threats/vendors/wolfssl, 9 November 2026.