CVE-2025-11933Medium· 6.5▾ SunlitImproper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a denial-of-service via a crafted ClientHello message with du…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a denial-of-service via a crafted ClientHello message with duplicate CKS extensions.
wolfssl >= 5.8.2, < 5.8.4Upgrade past the affected range:
wolfssl 5.8.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93302High· 8.2MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification
CVE-2026-93304Low· 3.7A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange
CVE-2026-89134Critical· 9.1A certificate with no dNSName SAN but another SAN type present (e.g
CVE-2026-89135Medium· 6.5A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM verify)
CVE-2026-89136High· 8.3When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication
CVE-2026-94417Medium· 5.3When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information Access OCSP URL, and accepts a certif…