wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c

OCSP stapling v2 multi accepts non-CA chain certificates as issuers

Failed X509_verify_cert leaves unverified CA in shared CertManager

TLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerify

PKCS#12 MAC verification uses attacker-controlled comparison length

ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

Partial-chain verification accepts untrusted intermediate as trust anchor

Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption

Heap Use-After-Free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.3

Integer underflow leads to out-of-bounds access in sniffer ChaCha decrypt path.

URI nameConstraints not enforced in ConfirmNameConstraints()

DoS Vulnerability in wolfSSL TLS 1.3 CKS Extension

In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server

Improper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication Bypass

Non-constant time multiplication subroutine __muldi3 on RISC-V RV32I

An issue was discovered in wolfSSL before 5.7.0

wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following options to…

wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle (MITM)…

An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is exploitable

wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension

It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLS

wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated

CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an…

wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low…

Integer Overflow in Certificate Chain Allocation

The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution

In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes it easier to extract RSA key information for a malicious user who has access to view cache on a machine

The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover AES keys by leveraging…

The C software implementation of RSA in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences

The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences

Client session cache reference poisoning allows resumption with wrong server

wolfSSL heap OOB read in PKCS7 SignedData streaming

TLS 1.2 Client Can Downgrade Digest Used

Heap use-after-free on read during bidirectional (D)TLS shutdown

NameConstraints not enforced across unconstrained intermediate CA

CRL check skipped when OCSP enabled and certificate has no OCSP URL

OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status

Encrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE_ENCRYPT_THEN_MAC is configured

CRL critical extension bypass in ParseCRL_Extensions

Integer underflow in wc_PKCS7_DecryptOri handling crafted Other Recipient Info

PKCS#7 decode ignores caller output buffer size, writing past buffer bounds

Wildcard DNS SAN bypasses CA name-constraint checks

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption)

PKCS7 CBC Padding Oracle — Plaintext Recovery

MatchDomainName 1-Byte Stack Buffer Over-Read in Hostname Validation

Integer underflow leads to out-of-bounds access in sniffer AES-GCM/CCM/ARIA-GCM decrypt path

Potential DoS Vulnerability through Multiple KeyShareEntry with Same Group in TLS 1.3 ClientHello

A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection

wolfSSL prior to 5.6.6 did not check that messages in one (D)TLS record do not span key boundaries

An issue was discovered in wolfSSL before 5.5.0