PT-2026-52605 · Wolfssl · Wolfssl

Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-8720

NVD

CVSS v4.0

5.9

Média

Vetor base

AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

wc Blake2bHmacFinal and wc Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.

Correção

Enumeração de Fraquezas

CWE-354

Identificadores relacionados

CVE-2026-8720

Produtos afetados

Wolfssl

Referências · 3

• https://github.com/wolfSSL/wolfssl/pull/10447 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-8720 · Nota de Segurança
• https://wolfssl.com/docs/security-vulnerabilities · Nota