CVE-2026-16516: critical vulnerability in wolfSSL Inc. wolfSSH
wolfSSH ECDSA host key curve not validated against negotiated algorithm
Published
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9epss 0.1%
exploitation probability
0.1%top 96% of all CVEs
observed exploitation
nono source reports it
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key).
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
Affected products
wolfSSL Inc. · wolfSSHRelated CVEs — wolfSSL Inc. wolfSSH
In the same product, most dangerous first.
CVE-2024-2873CRITICALUser authentication bypass in wolfSSH serverEPSS 0.6%CVE-2026-83742MEDIUMwstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platformsEPSS 0.3%CVE-2026-84897MEDIUMwolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusionEPSS 0.3%CVE-2026-81535MEDIUMwolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization checkEPSS 0.3%