目標達成 すべての支援者に感謝 — 100%達成しました!

目標: 1000 CNY · 調達済み: 1336 CNY

100%

wolfssl 厂商漏洞列表 / CVE 中文分析 94

wolfssl 厂商相关 94 条 CVE 漏洞,含 AI 中文分析、POC、CVSS 评分与受影响产品。

wolfSSL 是一款轻量级嵌入式 TLS 库,广泛用于物联网及资源受限设备,提供加密通信支持。其历史漏洞多集中于内存安全与协议解析缺陷,常见类型包括缓冲区溢出、空指针解引用及拒绝服务,极少涉及逻辑越权或远程代码执行。作为开源项目,其代码透明度高,但频繁更新以修复 CVE 问题。截至最新统计已收录 62 条 CVE,反映出其在复杂加密实现中仍需持续强化安全审计与边界检查机制。

87 件の結果 / 94フィルターをクリア
CVE IDタイトルCVSS深刻度公開日
CVE-2026-7511 PKCS7_verify signer confusion allows forged signatures to be accepted — wolfSSLCWE-347--2026-06-25
CVE-2026-7532 iPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined — wolfSSLCWE-295--2026-06-25
CVE-2026-8720 HMAC-BLAKE2 final discards message when key length exceeds block size — wolfSSLCWE-354--2026-06-25
CVE-2026-10098 OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status — wolfSSLCWE-295--2026-06-25
CVE-2026-11703 Missing SNI/ALPN binding on stateful (session-ID) TLS session resumption — wolfSSLCWE-287--2026-06-25
CVE-2026-55962 TLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerify — wolfSSLCWE-287--2026-06-25
CVE-2026-6092 Encrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE_ENCRYPT_THEN_MAC is configured — wolfSSLCWE-757--2026-06-25
CVE-2026-6325 Out-of-bounds write in SetSuitesHashSigAlgo on oversized signature algorithms list — wolfSSLCWE-787--2026-06-25
CVE-2026-6329 PKCS#12 MAC verification uses attacker-controlled comparison length — wolfSSLCWE-347--2026-06-25
CVE-2026-6330 ML-KEM ARM64 NEON ciphertext comparison only compares half of the input — wolfSSLCWE-327--2026-06-25
CVE-2026-6331 HMAC zero-length tag forgery in EVP_DigestVerifyFinal — wolfSSLCWE-347--2026-06-25
CVE-2026-6412 Continued acceptance of SHA-1/MD5 digests in certificate processing — wolfSSLCWE-327--2026-06-25
CVE-2026-6450 CRL critical extension bypass in ParseCRL_Extensions — wolfSSLCWE-295--2026-06-25
CVE-2026-6678 Integer underflow in wc_PKCS7_DecryptOri handling crafted Other Recipient Info — wolfSSLCWE-191--2026-06-25
CVE-2026-6679 DTLS 1.3 ACK serialization heap buffer overflow via integer truncation — wolfSSLCWE-787--2026-06-25
CVE-2026-6681 PKCS#7 decode ignores caller output buffer size, writing past buffer bounds — wolfSSLCWE-787--2026-06-25
CVE-2026-6731 X.509 name constraint bypass via Subject CN treated as a DNS name — wolfSSLCWE-295--2026-06-25
CVE-2026-7531 Use-after-free in PQC hybrid key-share handling — wolfSSLCWE-416--2026-06-25
CVE-2026-10097 ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery — wolfSSLCWE-697--2026-06-25
CVE-2026-10512 X25519 x86_64 assembly final reduction leaves non-canonical field element — wolfSSLCWE-682--2026-06-25
CVE-2026-10592 Wildcard DNS SAN bypasses CA name-constraint checks — wolfSSLCWE-295--2026-06-25
CVE-2026-11310 X.509 trust-chain bypass in wolfSSL_X509_verify_cert() via untrusted intermediate anchoring — wolfSSLCWE-295--2026-06-25
CVE-2026-12340 Out-of-bounds heap read in SM2/SM3 certificate Subject Key Identifier computation — wolfSSLCWE-125--2026-06-25
CVE-2026-55958 Renesas TSIP TLS 1.3 transcript buffer out-of-bounds write in tsip_StoreMessage — wolfSSLCWE-787--2026-06-25
CVE-2026-55960 Un-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validation — wolfSSLCWE-295--2026-06-25
CVE-2026-55964 Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption) — wolfSSLCWE-295--2026-06-25
CVE-2026-11999 X.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert() — wolfSSLCWE-295--2026-06-25
CVE-2026-55967 AES-GCM streaming APIs do not reject >64 GiB cumulative single messages, enabling counter wrap and keystream reuse — wolfSSLCWE-323--2026-06-25
CVE-2026-55961 wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer — wolfSSLCWE-347--2026-06-25
CVE-2026-6091 Partial-chain verification accepts untrusted intermediate as trust anchor — wolfSSLCWE-295--2026-06-25

本页汇总了 wolfssl 厂商截至目前公开的全部 94 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接,并附带 AI 生成的中文分析以便快速判断风险。