High severity · published Jun 25, 2026
CVE-2026-8720
HMAC-BLAKE2 final discards message when key length exceeds block size
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WO
wolfSSL · wolfSSL
5.9.0 through 5.9.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8720
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8720
Issue Tracking
https://github.com/wolfSSL/wolfssl/pull/10447
Vendor Advisory
https://www.wolfssl.com/docs/security-vulnerabilities/
More from wolfSSL
9.8
CVE-2026-7531
Use-after-free in PQC hybrid key-share handling
9.8
CVE-2026-5264
DTLS 1.3 ACK heap buffer overflow
9.8
CVE-2026-5187
Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL
9.8
CVE-2026-4395
Heap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path
9.8
CVE-2026-3849
Buffer Overflow in HPKE via Oversized ECH Config