Advisories · Technology
wolfSSL Inc. wolfSSH.
Every CVE that names wolfSSL Inc. wolfSSH among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion
- wolfSSL Inc. wolfSSH
- Denial of service
- CWE-372
- CVSS 5.3 Medium
wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platforms
- wolfSSL Inc. wolfSSH
- Memory corruption
- CWE-193
- CVSS 6.3 Medium
wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check
- wolfSSL Inc. wolfSSH
- Broken access control
- CVSS 9.0 CriticalCritical · CVSS 9+
wolfSSH ECDSA host key curve not validated against negotiated algorithm
- wolfSSL Inc. wolfSSH
- CWE-345
- CVSS 9.1 CriticalCritical · CVSS 9+
User authentication bypass in wolfSSH server
- wolfSSL Inc. wolfSSH
- Authentication bypass