PT-2026-31813 · Wolfssl · Wolfssl

Zou Dikai · CVE-2026-5778 · Published 2026-04-09 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions wolfSSL versions 5.9.0 and earlier

Description An integer underflow in the packet sniffer component of wolfSSL versions 5.9.0 and earlier can lead to a program crash. This occurs in the AEAD decryption path when processing malformed TLS Application Data records. Specifically, injecting a TLS record shorter than the expected length can trigger the underflow, resulting in a large out-of-bounds read during AEAD decryption. This can be exploited remotely by an unauthenticated attacker.

Recommendations Update wolfSSL to a version later than 5.9.0.

Exploit

Fix

DoS

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-5778

JLSEC-2026-741

Affected Products

Wolfssl

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5778.json · Exploit
• https://github.com/wolfSSL/wolfssl/pull/10125 · Patch
• https://osv.dev/vulnerability/JLSEC-2026-741 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5778 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-5778 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5778 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5778 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5778 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5778 · Security Note
• https://github.com/advisories/GHSA-2jvp-h4w4-2vxh · Note
• https://twitter.com/CVEnew/status/2042364280830320708 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042392811018789342 · Twitter Post