185 matches found
PT-2026-107387
Name of the Vulnerable Software and Affected Versions wolfSSH versions prior to 1.5.1 Description When built with the --enable-fwd flag, the DoChannelOpen function in src/internal.c only applies the forwarding policy callback to direct-tcpip channel opens. Consequently, forwarded-tcpip opens are...
PT-2026-107386
Name of the Vulnerable Software and Affected Versions wolfSSH affected versions not specified Description wolfSSH fails to validate that the ECDSA curve identifier in a KEXDH REPLY host key blob matches the algorithm negotiated during key exchange. In the ParseECCPubKey function, the blob's...
PT-2026-107389
Name of the Vulnerable Software and Affected Versions wolfSSL wolfSSH versions 1.4.11 through 1.5.0 Description An unsigned integer underflow occurs in the wstrncat function within src/port.c on non-Windows platforms. This issue allows an authenticated remote attacker to write a single null byte...
CVE-2026-81535: Missing Authorization
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an...
CVE-2026-83742: Integer Underflow (Wrap or Wraparound)
Unsigned integer underflow in wstrncat in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of a stack buffer by sending a crafted SFTP path. wolfSSHRealPath in src/ssh.c...
PT-2026-107390
Name of the Vulnerable Software and Affected Versions wolfSSL wolfSSH versions 1.2.0 through 1.5.0 Description In the src/internal.c file, the server incorrectly accepts server-to-client Diffie-Hellman group exchange messages, specifically SSH MSG KEX DH GEX GROUP 31 and SSH MSG KEX DH GEX REPLY...
K000163564: Curl vulnerabilities CVE-2025-13034 and CVE-2025-10966
Security Advisory Description CVE-2025-13034 When using CURLOPTPINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool, curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the...
wolfssh:fuzz_server: Null-dereference READ in ubsan_GetStackTrace
Detailed Report: https://oss-fuzz.com/testcase?key=6413439160614912 Project: wolfssh Fuzzing Engine: libFuzzer Fuzz Target: fuzzserver Job Type: libfuzzerubsanwolfssh Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: ubsanGetStackTrace Sanitizer:...
JLSEC-2026-424 curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was...
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more...
CVE-2026-0930 Potential wolfSSHd Buffer out-of-bounds Read on Windows Handling Terminal Resize
Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds read after establishing a connection which would leak the adjacent stack memory to the pseudo-console output...
WolfSSH security vulnerability
WolfSSH is a small, fast, and portable SSH implementation of wolfSSL, including support for SCP and SFTP. WolfSSH has security vulnerabilities, particularly an out-of-bounds read vulnerability when handling terminal resizing requests, which may lead to authenticated users leaking adjacent stack...
curl: Curl missing SFTP host verification with wolfSSH backend
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. As the wolfSSH backend was documented as incomplete and fail tests, it is not expected that many users execute this code in production...
wolfssl:fuzzer-wolfssh-client-randomize: Memcpy-param-overlap in SendKexDhInit
Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5582356961624064 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-client-randomize Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Memcpy-param-overlap Crash...
EulerOS Virtualization 2.12.1 : curl (EulerOS-SA-2026-1421)
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : When doing multi-threaded LDAPS transfers LDAP over TLS with libcurl,changing TLS options in one thread would inadvertently change th...
EulerOS 2.0 SP11 : curl (EulerOS-SA-2026-1574)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.Thi...
EulerOS 2.0 SP11 : curl (EulerOS-SA-2026-1602)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.Thi...
EulerOS Virtualization 2.12.0 : curl (EulerOS-SA-2026-1478)
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : When doing multi-threaded LDAPS transfers LDAP over TLS with libcurl,changing TLS options in one thread would inadvertently change th...
wolfSSH Authentication Defect
The vulnerability of the SSH library wolfSSH is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...
Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2026-1219)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2026-1207)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...