CVE-2026-6092

When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC.

Score

CVSS 3.1 5.3 Medium

Status

Analyzed - facts@wolfssl.com

Published

2026-06-25

Last modified

2026-06-26

Weaknesses

CWE-757

Affected products

• Wolfssl (Wolfssl)

References

• https://github.com/wolfSSL/wolfssl/pull/10167
• https://www.wolfssl.com/docs/security-vulnerabilities/