Wolfssh (Wolfssl) - vulnerabilities (CVEs)

5 CVEs, 1 in the last 30 days, 2 known versions, newest CVE from 2026-10-07. Vendor: Wolfssl.

CVEs of Wolfssh

• CVE-2026-83540 - CVSS 8.8 (high), 2026-10-07: When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not…
• CVE-2026-0930 - CVSS 4.3 (medium), 2026-04-20: Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger the out of bounds…
• CVE-2025-15382 - CVSS 8.1 (high), 2026-01-06: A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via…
• CVE-2025-14942 - CVSS 9.8 (critical), 2026-01-06: wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the…
• CVE-2025-11625 - CVSS 9.8 (critical), 2025-10-21: Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials.