CVE-2026-16516

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

CVE-2026-16516

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

CVE-2026-16516

The wolfSSH library contains a vulnerability in the ParseECCPubKey() function (located in src/internal.c) where it fails to validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the negotiated algorithm during the key exchange. Specifically, the software uses the blob's ...

CVE-2026-16516

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...