CVE-2026-84897— wolfSSH 服务器接受未认证客户端的DH组交换消息，导致CPU耗尽和密钥交换角色混淆
一分钟漏洞结论
影响对象
wolfSSL Inc. wolfSSH
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
以下是该漏洞描述信息的中文翻译： 在 wolfSSL wolfSSH 1.5.0 及更早版本中，当服务器从未经身份验证的客户端接收 SSH_MSG_KEX_DH_GEX_GROUP（31）和 SSH_MSG_KEX_DH_GEX_REPLY（33）服务器到客户端的 Diffie-Hellman 组交换消息时，会允许这些消息。 函数在密钥交换消息范围上未施加方向性检查：当对端处于密钥协商状态且没有预期特定消息时（即服务器在处理完客户端的 KEXINIT 之后的整个窗口期内所处的状态，因为此时没有设置 ），该函数会从期
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-84897 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion
来源: CVE Program / CVE List V5
Vulnerability Description
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_REPLY (33) when a server receives them from an unauthenticated client. IsMessageAllowedServer() applies no direction check to the key exchange message range: when the peer is keying and no particular message is expected, which is the state a server is in for the whole window after it processes the client's KEXINIT because nothing sets handshake->expectMsgId there, the function falls out of its expectation branch without a verdict and reaches a numeric bound that admits every message id from 30 through 34. A client that negotiates diffie-hellman-group-exchange-sha256 and then sends message 31 makes the server run the client-side handler DoKexDhGexGroup(), which validates the attacker-supplied group with two 8-round Miller-Rabin primality tests, one on p and one on (p-1)/2, on a value of up to 8192 bits. The handler then returns success: the server stores the attacker's prime and generator, generates a Diffie-Hellman key pair in the attacker's group, and sends the client-role message SSH_MSG_KEX_DH_GEX_INIT (32) back to the attacker. Published RFC 3526 safe primes are the worst-case input and cost the attacker nothing to obtain. The primality validation was added in 1.5.0; versions from 1.2.0 through 1.4.22 admit the same message and enter the same client-role path without the primality cost. Message 33 is admitted as well, but on a server it is rejected before any cryptography because no public key check callback is registered, so it carries no comparable cost. Builds that define WOLFSSH_NO_DH_GEX_SHA256, which is implied by WOLFSSH_NO_DH or NO_SHA256, are unaffected.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y
来源: CVE Program / CVE List V5
Vulnerability Type
不完整的内部状态区分
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| wolfSSL Inc. | wolfSSH | 1.2.0 ~ 1.5.0 | - |
|
二、漏洞 CVE-2026-84897 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-84897 的情报信息
请登录查看更多情报信息。
CVE-2026-84897 补丁与修复 (2)
CVE-2026-84897 新闻报道 (1)
同批安全公告 · wolfSSL Inc. · 2026-10-07 · 共 4 条
| CVE-2026-16516 | 9.0 CRITICAL | wolfSSH ECDSA主机密钥曲线未验证 |
| CVE-2026-81535 | 6.3 MEDIUM | wolfSSH SSH客户端未授权接受未请求的转发-tcpip通道 |
| CVE-2026-83742 | 5.3 MEDIUM | wolfSSH wstrncat()整数下溢导致空字节越界写入漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-84897
暂无评论