Authentication Bypass

Host verification bypass and credential leak

Buffer overwrite when processing file handles with the SFTP server

WolfSSH v1.4.7 was discovered to contain an integer overflow via the function wolfSSH_SFTP_RecvRMDIR

wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check

User authentication bypass in wolfSSH server

wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms

wolfSSHd on Windows race condition leading to logon token reused across connections

Client SCP Request Triggers Buffer Overread by 1 Byte

wolfSSH ECDSA host key curve not validated against negotiated algorithm

wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion

Potential wolfSSHd Buffer out-of-bounds Read on Windows Handling Terminal Resize