Package: libwolfssl-dev (5.7.2-0.1+deb13u1)

Published: Oct 8, 2026, 4:18:01 PM UTC

An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of Service (DoS) via providing crafted Certificate Authority cer

Published: Sep 27, 2026, 10:16:59 AM UTC

When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information

Published: Sep 27, 2026, 10:16:59 AM UTC

A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a kno

Published: Sep 27, 2026, 10:16:59 AM UTC

MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and load CA certificates with wolf

Published: Sep 27, 2026, 10:16:59 AM UTC

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to

Published: Sep 27, 2026, 10:16:59 AM UTC

A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subject

Published: Sep 27, 2026, 10:16:58 AM UTC

wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when there is an unconstrained CA tier between

Published: Sep 27, 2026, 10:16:58 AM UTC

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OC

Published: Sep 27, 2026, 10:16:56 AM UTC

In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use-after free. If an application ended up g

Published: Sep 27, 2026, 9:16:36 AM UTC

Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index, hash(sessionID)} into the process-global SessionCache, and C

Published: Sep 27, 2026, 9:16:36 AM UTC

Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then merges the two results, but it merged the signatur

Published: Sep 27, 2026, 10:16:59 AM UTC

A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, dir

Published: Jun 25, 2026, 10:17:03 PM UTC

wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the B

Die Paketzuordnung läuft. Beobachtet: Oct 23, 2026, 9:45:23 PM UTC

Published: Jun 25, 2026, 10:17:03 PM UTC

iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certificate to bypass an issuing CA's IP addre

Die Paketzuordnung läuft. Beobachtet: Oct 23, 2026, 9:45:23 PM UTC

Published: Jun 25, 2026, 10:17:03 PM UTC

PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bound, permitting a forged signature to be accepted.

Die Paketzuordnung läuft. Beobachtet: Oct 23, 2026, 9:45:23 PM UTC

Published: Jun 25, 2026, 10:17:03 PM UTC

HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC verify path the supplied signature

Die Paketzuordnung läuft. Beobachtet: Oct 23, 2026, 9:45:23 PM UTC

Published: Jun 25, 2026, 10:17:02 PM UTC

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constan

Die Paketzuordnung läuft. Beobachtet: Oct 23, 2026, 9:45:23 PM UTC

Published: Jun 25, 2026, 10:17:02 PM UTC

PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted. The PKCS#12 verify path compared the loca

Die Paketzuordnung läuft. Beobachtet: Oct 23, 2026, 9:45:23 PM UTC

Published: Jun 25, 2026, 10:17:02 PM UTC

Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write past the bounds of the destination buffer.

Die Paketzuordnung läuft. Beobachtet: Oct 23, 2026, 9:45:23 PM UTC

Published: Jun 25, 2026, 10:17:02 PM UTC

When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC.

Die Paketzuordnung läuft. Beobachtet: Oct 23, 2026, 9:45:23 PM UTC