wolfSSHd (Product): news timeline & CVEs

wolfSSH Patches 5 Security Vulnerabilities, Including Critical SSH Authentication Bypass

wolfSSL's wolfSSH 1.6.0 patches five flaws, including a critical ECDSA host-key authentication bypass.

wolfSSL released wolfSSH 1.6.0 on October 6, 2026, fixing five vulnerabilities in versions through 1.5.0. CVE-2026-16516 (CVSS v4 9.0) lets an active man-in-the-middle attacker bypass ECDSA host-key checks when a permissive validation callback is used. CVE-2026-83540 (CVSS 7.7) can let a lower-privileged Windows wolfSSHd user reuse another user's logon token. Three medium issues cover Diffie-Hellman CPU exhaustion (CVE-2026-84897), unauthorized TCP forwarding (CVE-2026-81535), and a one-byte SFTP path overflow (CVE-2026-83742). The release also enables strict key exchange by default against the Terrapin attack (CVE-2023-48795).

GBHackersOct 8, 11:10 UTC · 2d agoVulnerability 3 sources CVE-2026-16516 CVE-2026-83540 CVE-2026-84897+3 CVEs3

wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass

wolfSSL released wolfSSH 1.6.0, fixing five flaws including a critical SSH host-key verification bypass.

wolfSSL published wolfSSH 1.6.0 on October 6, 2026, patching five vulnerabilities affecting versions through 1.5.0: one critical, one high, and three medium. Critical CVE-2026-16516 lets a man-in-the-middle replace the server ECDSA host key with a different curve so signature checks succeed, but only if the application uses a weak public-key-checking callback. High-severity CVE-2026-83540 affects Windows wolfSSHd 1.4.15 through 1.5.0, where shared logon tokens can give one authenticated user another account’s identity. The remaining flaws are unauthenticated Diffie-Hellman group-exchange CPU abuse (CVE-2026-84897), policy-bypass TCP forwarding (CVE-2026-81535), and an authenticated SFTP NUL overflow (CVE-2026-83742); 1.6.0 also enables strict key exchange and 2048-bit minimum RSA user keys.

Cyber Security Newsupdated Oct 8, 11:10 UTC · 2d agofirst Oct 8, 10:23 UTC · 2d agoVulnerability 3 sources CVE-2026-16516 CVE-2026-83540

wolfSSHd

Timeline2 articles

Related CVEsby mentions

Appears with

wolfSSH Patches 5 Security Vulnerabilities, Including Critical SSH Authentication Bypass

wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass