wolfSSL (Organization): news timeline & CVEs

Claude Helps Secure Open Source as Anthropic Offers Free Vulnerability Scanning

Anthropic launched free OSS Scanner, using Claude to find and report open-source vulnerabilities to maintainers.

Anthropic opened OSS Scanner, a free opt-in service that uses its strongest models, including Claude Mythos, to scan open-source projects. Over six months it found more than 29,000 candidate flaws and manually confirmed about 6,000; nearly 5,000 unverified reports went to maintainers who requested them. Expert review of 97 critical and high findings across 48 projects found 85 met CVD standards and only one false positive. Maintainers of curl, wolfSSL, and OpenSSL said recent reports were useful, and wolfSSL said five findings became CVEs.

Security Affairsupdated Oct 9, 17:54 UTC · 1d agofirst Oct 9, 13:56 UTC · 1d agoTools 7 sources

wolfSSH Patches 5 Security Vulnerabilities, Including Critical SSH Authentication Bypass

wolfSSL's wolfSSH 1.6.0 patches five flaws, including a critical ECDSA host-key authentication bypass.

wolfSSL released wolfSSH 1.6.0 on October 6, 2026, fixing five vulnerabilities in versions through 1.5.0. CVE-2026-16516 (CVSS v4 9.0) lets an active man-in-the-middle attacker bypass ECDSA host-key checks when a permissive validation callback is used. CVE-2026-83540 (CVSS 7.7) can let a lower-privileged Windows wolfSSHd user reuse another user's logon token. Three medium issues cover Diffie-Hellman CPU exhaustion (CVE-2026-84897), unauthorized TCP forwarding (CVE-2026-81535), and a one-byte SFTP path overflow (CVE-2026-83742). The release also enables strict key exchange by default against the Terrapin attack (CVE-2023-48795).

GBHackersOct 8, 11:10 UTC · 2d agoVulnerability 3 sources CVE-2026-16516 CVE-2026-83540 CVE-2026-84897+3 CVEs3

wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass

wolfSSL released wolfSSH 1.6.0, fixing five flaws including a critical SSH host-key verification bypass.

wolfSSL published wolfSSH 1.6.0 on October 6, 2026, patching five vulnerabilities affecting versions through 1.5.0: one critical, one high, and three medium. Critical CVE-2026-16516 lets a man-in-the-middle replace the server ECDSA host key with a different curve so signature checks succeed, but only if the application uses a weak public-key-checking callback. High-severity CVE-2026-83540 affects Windows wolfSSHd 1.4.15 through 1.5.0, where shared logon tokens can give one authenticated user another account’s identity. The remaining flaws are unauthenticated Diffie-Hellman group-exchange CPU abuse (CVE-2026-84897), policy-bypass TCP forwarding (CVE-2026-81535), and an authenticated SFTP NUL overflow (CVE-2026-83742); 1.6.0 also enables strict key exchange and 2048-bit minimum RSA user keys.

Cyber Security Newsupdated Oct 8, 11:10 UTC · 2d agofirst Oct 8, 10:23 UTC · 2d agoVulnerability 3 sources CVE-2026-16516 CVE-2026-83540

wolfSSL security advisory (AV26-1016)

Canada's Cyber Centre warned that wolfSSH before 1.6.0 is vulnerable and urged administrators to update.

The Canadian Centre for Cyber Security issued advisory AV26-1016 on October 7, 2026, stating that wolfSSH versions before 1.6.0 are affected by vulnerabilities. It directs administrators to the wolfSSH 1.6.0 release from October 6, 2026, and recommends applying available updates. The bulletin does not list CVE identifiers, describe the flaws, or report active exploitation.

Canadian Centre for Cyber Securityupdated Oct 8, 11:10 UTC · 2d agofirst Oct 7, 18:39 UTC · 3d agoAdvisory 3 sources2· 1 read

High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL

OpenSSL and wolfSSL patched roughly 25 vulnerabilities, including an 8.2-rated DTLS heap data leak and certificate authentication bypasses affecting Nginx and HAProxy builds.

OpenSSL fixed 14 flaws, led by CVE-2026-84782 (CVSS 8.2), which lets an unauthenticated remote peer obtain heap memory fragments or crash DTLS applications common in VPNs, VoIP and IoT products. wolfSSL 5.9.4 patches 11 vulnerabilities including three high-severity authentication bypasses (CVE-2026-93302, CVE-2026-89102, CVE-2026-89136) enabling server impersonation and forged certificates. Remaining flaws mainly cause DoS, QUIC DDoS amplification, or timing side-channel leaks relevant to private key recovery. No exploitation was reported.

SecurityWeekSep 30, 06:55 UTC · 10d agoVulnerability CVE-2026-84782 CVE-2026-84783 CVE-2026-93302+2 CVEs1

wolfSSL 5.9.4 Fixes 11 TLS Security Flaws and Expands Post-Quantum Cryptography Support

wolfSSL 5.9.4 patches 11 TLS vulnerabilities, including three high-severity certificate validation bypasses, and adds post-quantum cryptography features.

wolfSSL 5.9.4 fixes 11 CVEs (three high, four medium, four low) in its embedded TLS/cryptography library, most affecting specific build options rather than default configurations. High-severity issues include CVE-2026-93302 (trusted-peer certificate bypass via forged CA clone), CVE-2026-89102 (OCSP stapling certificate forgery), and CVE-2026-89136 (Raw Public Key authentication bypass), affecting versions from 3.15.5 through 5.9.2. The release also expands post-quantum support with native Falcon signatures, FrodoKEM, SLH-DSA for TLS 1.3, and PQ-only ML-KEM/ML-DSA configurations. wolfSSL warns that long-running applications may need full process restarts because certificate or session state can persist in memory.

Cyber Security NewsSep 29, 09:19 UTC · 11d agoVulnerability CVE-2026-93302 CVE-2026-89102 CVE-2026-89136+8 CVEs1

wolfSSL

Timeline6 articles

Related CVEsby mentions

Appears with