CVE-2025-11933

Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a denial-of-service via a crafted ClientHello message with duplicate CKS extensions.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - facts@wolfssl.com

Published

2025-11-21

Last modified

2026-10-08

Weaknesses

CWE-20

Affected products

• Wolfssl (Wofssl)
• Wolfssl (Wolfssl)

References

• https://github.com/wolfSSL/wolfssl
• https://github.com/wolfSSL/wolfssl/pull/9132