PT-2026-1769 · Pypi · Wolfssl-Py

Matan Radomski · Published 2026-01-07 · Updated 2026-01-09 · CVE-2025-15346

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions wolfssl-py versions up to and including 5.8.2

Description A flaw exists in the handling of verify mode = CERT REQUIRED within the wolfssl Python package (wolfssl-py). The absence of the WOLFSSL VERIFY FAIL IF NO PEER CERT flag causes the software to behave as if CERT OPTIONAL is enabled, meaning a peer certificate is verified if presented, but connections are incorrectly authenticated when no client certificate is provided. This results in improper authentication, potentially allowing attackers to bypass mutual TLS (mTLS) client authentication by omitting a client certificate during the TLS handshake.

Recommendations Versions up to and including 5.8.2 should be updated to a newer version that includes the WOLFSSL VERIFY FAIL IF NO PEER CERT flag when verify mode = CERT REQUIRED is used.

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2025-15346

GHSA-VJ87-JJ27-4H9C

Affected Products

Wolfssl-Py

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-15346 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-15346 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-15346 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vj87-jj27-4h9c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-15346 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl-py/releases/tag/v5.8.4-stable · Note
• https://github.com/wolfSSL/wolfssl-py/pull/62 · Note
• https://github.com/wolfSSL/wolfssl-py/commit/b4517dece79f682a8f453abce5cfc0b81bae769d · Note
• https://github.com/wolfSSL/wolfssl-py · Note
• https://twitter.com/CVEnew/status/2009149986299367815 · Twitter Post
• https://twitter.com/0dayPublishing/status/2009047628609171526 · Twitter Post
• https://twitter.com/pulsepatchio/status/2009634064802754756 · Twitter Post
• https://t.me/CVEtracker/41661 · Telegram Post