wolfSSH (Product): news timeline & CVEs

wolfSSH Patches 5 Security Vulnerabilities, Including Critical SSH Authentication Bypass

wolfSSL's wolfSSH 1.6.0 patches five flaws, including a critical ECDSA host-key authentication bypass.

wolfSSL released wolfSSH 1.6.0 on October 6, 2026, fixing five vulnerabilities in versions through 1.5.0. CVE-2026-16516 (CVSS v4 9.0) lets an active man-in-the-middle attacker bypass ECDSA host-key checks when a permissive validation callback is used. CVE-2026-83540 (CVSS 7.7) can let a lower-privileged Windows wolfSSHd user reuse another user's logon token. Three medium issues cover Diffie-Hellman CPU exhaustion (CVE-2026-84897), unauthorized TCP forwarding (CVE-2026-81535), and a one-byte SFTP path overflow (CVE-2026-83742). The release also enables strict key exchange by default against the Terrapin attack (CVE-2023-48795).

GBHackersOct 8, 11:10 UTC · 2d agoVulnerability 3 sources CVE-2026-16516 CVE-2026-83540 CVE-2026-84897+3 CVEs3

wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass

wolfSSL released wolfSSH 1.6.0, fixing five flaws including a critical SSH host-key verification bypass.

wolfSSL published wolfSSH 1.6.0 on October 6, 2026, patching five vulnerabilities affecting versions through 1.5.0: one critical, one high, and three medium. Critical CVE-2026-16516 lets a man-in-the-middle replace the server ECDSA host key with a different curve so signature checks succeed, but only if the application uses a weak public-key-checking callback. High-severity CVE-2026-83540 affects Windows wolfSSHd 1.4.15 through 1.5.0, where shared logon tokens can give one authenticated user another account’s identity. The remaining flaws are unauthenticated Diffie-Hellman group-exchange CPU abuse (CVE-2026-84897), policy-bypass TCP forwarding (CVE-2026-81535), and an authenticated SFTP NUL overflow (CVE-2026-83742); 1.6.0 also enables strict key exchange and 2048-bit minimum RSA user keys.

Cyber Security Newsupdated Oct 8, 11:10 UTC · 2d agofirst Oct 8, 10:23 UTC · 2d agoVulnerability 3 sources CVE-2026-16516 CVE-2026-83540

wolfSSL security advisory (AV26-1016)

Canada's Cyber Centre warned that wolfSSH before 1.6.0 is vulnerable and urged administrators to update.

The Canadian Centre for Cyber Security issued advisory AV26-1016 on October 7, 2026, stating that wolfSSH versions before 1.6.0 are affected by vulnerabilities. It directs administrators to the wolfSSH 1.6.0 release from October 6, 2026, and recommends applying available updates. The bulletin does not list CVE identifiers, describe the flaws, or report active exploitation.

Canadian Centre for Cyber Securityupdated Oct 8, 11:10 UTC · 2d agofirst Oct 7, 18:39 UTC · 3d agoAdvisory 3 sources2· 1 read

wolfSSH

Timeline3 articles

Related CVEsby mentions

Appears with

wolfSSH Patches 5 Security Vulnerabilities, Including Critical SSH Authentication Bypass

wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass

wolfSSL security advisory (AV26-1016)