wolfSSL (Vendor): news timeline & CVEs

wolfSSH Patches 5 Security Vulnerabilities, Including Critical SSH Authentication Bypass

wolfSSL's wolfSSH 1.6.0 patches five flaws, including a critical ECDSA host-key authentication bypass.

wolfSSL released wolfSSH 1.6.0 on October 6, 2026, fixing five vulnerabilities in versions through 1.5.0. CVE-2026-16516 (CVSS v4 9.0) lets an active man-in-the-middle attacker bypass ECDSA host-key checks when a permissive validation callback is used. CVE-2026-83540 (CVSS 7.7) can let a lower-privileged Windows wolfSSHd user reuse another user's logon token. Three medium issues cover Diffie-Hellman CPU exhaustion (CVE-2026-84897), unauthorized TCP forwarding (CVE-2026-81535), and a one-byte SFTP path overflow (CVE-2026-83742). The release also enables strict key exchange by default against the Terrapin attack (CVE-2023-48795).

GBHackersOct 8, 11:10 UTC · 2d agoVulnerability 3 sources CVE-2026-16516 CVE-2026-83540 CVE-2026-84897+3 CVEs3

wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass

wolfSSL released wolfSSH 1.6.0, fixing five flaws including a critical SSH host-key verification bypass.

wolfSSL published wolfSSH 1.6.0 on October 6, 2026, patching five vulnerabilities affecting versions through 1.5.0: one critical, one high, and three medium. Critical CVE-2026-16516 lets a man-in-the-middle replace the server ECDSA host key with a different curve so signature checks succeed, but only if the application uses a weak public-key-checking callback. High-severity CVE-2026-83540 affects Windows wolfSSHd 1.4.15 through 1.5.0, where shared logon tokens can give one authenticated user another account’s identity. The remaining flaws are unauthenticated Diffie-Hellman group-exchange CPU abuse (CVE-2026-84897), policy-bypass TCP forwarding (CVE-2026-81535), and an authenticated SFTP NUL overflow (CVE-2026-83742); 1.6.0 also enables strict key exchange and 2048-bit minimum RSA user keys.

Cyber Security Newsupdated Oct 8, 11:10 UTC · 2d agofirst Oct 8, 10:23 UTC · 2d agoVulnerability 3 sources CVE-2026-16516 CVE-2026-83540

wolfSSL security advisory (AV26-1016)

Canada's Cyber Centre warned that wolfSSH before 1.6.0 is vulnerable and urged administrators to update.

The Canadian Centre for Cyber Security issued advisory AV26-1016 on October 7, 2026, stating that wolfSSH versions before 1.6.0 are affected by vulnerabilities. It directs administrators to the wolfSSH 1.6.0 release from October 6, 2026, and recommends applying available updates. The bulletin does not list CVE identifiers, describe the flaws, or report active exploitation.

Canadian Centre for Cyber Securityupdated Oct 8, 11:10 UTC · 2d agofirst Oct 7, 18:39 UTC · 3d agoAdvisory 3 sources2· 1 read

wolfSSL 5.9.4 Patches 11 Security Flaws Affecting TLS and Certificate Validation

wolfSSL 5.9.4 fixes 11 TLS and certificate-validation flaws, including trusted-peer and OCSP authentication bypasses.

wolfSSL 5.9.4 fixes 11 flaws in TLS and DTLS handshakes, X.509 validation, OCSP stapling, session resumption, and memory safety. CVE-2026-93302, affecting 5.3.0 through 5.9.2, can let a forged CA clone pass trusted-peer checks when WOLFSSL_TRUST_PEER_CERT is enabled. High-severity CVE-2026-89102 and CVE-2026-89136 may bypass authentication in multi-OCSP and Raw Public Key builds. Other fixes include ChangeCipherSpec ordering, NameConstraints bypasses, skipped CRL checks, session-cache poisoning, and a heap use-after-free. No exploitation is reported.

GBHackersSep 29, 10:18 UTC · 11d agoVulnerability CVE-2026-93302 CVE-2026-89102 CVE-2026-89136+7 CVEs2· 1 read

wolfSSL security advisory (AV26-969)

Canada's Cyber Centre warns wolfSSL 5.9.4 and earlier are affected and urges administrators to update.

The Canadian Centre for Cyber Security issued advisory AV26-969 on September 28, 2026, stating wolfSSL versions up to and including 5.9.4 are affected by vulnerabilities. The bulletin points to a September 25, 2026 wolfSSL release but does not list CVE identifiers or describe the flaws. It urges users and administrators to review the vendor release and apply necessary updates.

Canadian Centre for Cyber SecuritySep 28, 18:35 UTC · 12d agoAdvisory1· 1 read

wolfSSL

Timeline5 articles

Related CVEsby mentions

Appears with

wolfSSH Patches 5 Security Vulnerabilities, Including Critical SSH Authentication Bypass

wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass

wolfSSL security advisory (AV26-1016)

wolfSSL 5.9.4 Patches 11 Security Flaws Affecting TLS and Certificate Validation

wolfSSL security advisory (AV26-969)