ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery

X25519 x86_64 assembly final reduction leaves non-canonical field element

X.509 trust-chain bypass in wolfSSL_X509_verify_cert() via untrusted intermediate anchoring

Out-of-bounds heap read in SM2/SM3 certificate Subject Key Identifier computation

Renesas TSIP TLS 1.3 transcript buffer out-of-bounds write in tsip_StoreMessage

Un-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validation

X.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert()

AES-GCM streaming APIs do not reject >64 GiB cumulative single messages, enabling counter wrap and keystream reuse

wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer

Prefix-substitution forgery via integer overflow in wolfCrypt CMAC

Heap buffer overflow in CertFromX509() via AuthorityKeyIdentifier

wolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validation

Acceptance of CertificateVerify Message before ClientKeyExchange in TLS 1.2

Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limitations, specifically…

With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with the connection…

In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked

In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake

An issue was discovered in wolfSSL before 5.5.0

wolfSSL before 5.4.0 allows remote attackers to cause a denial of service via DTLS because a check for return-routability can be skipped

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication

An issue was discovered in wolfSSL before 4.5.0

wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks

wolfSSL before 4.3.0 mishandles calls to wc_SignatureGenerateHash, leading to fault injection in RSA cryptography

wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication

wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates

wolfssl before 3.2.0 does not properly issue certificates for a server's hostname

In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking

wolfSSL before 3.11.0 does not prevent wc_DhAgree from accepting a malformed DH key

wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or traffic amplification) via a crafted DTLS cookie in a…

wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse

Stack buffer overflow in PKCS7 SignedData encoding with custom signed attributes

An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed

wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c

OCSP stapling v2 multi accepts non-CA chain certificates as issuers

Failed X509_verify_cert leaves unverified CA in shared CertManager

TLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerify

PKCS#12 MAC verification uses attacker-controlled comparison length

ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

Partial-chain verification accepts untrusted intermediate as trust anchor

Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption

Heap Use-After-Free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.3

Integer underflow leads to out-of-bounds access in sniffer ChaCha decrypt path.

URI nameConstraints not enforced in ConfirmNameConstraints()

Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a…

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server

Improper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication Bypass

Non-constant time multiplication subroutine __muldi3 on RISC-V RV32I

An issue was discovered in wolfSSL before 5.7.0

wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following options to…

wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle (MITM)…