Improper Input Validation in wolfSSL TLS 1.3 CKS Extension Parsing
CVE-2025-11933

2.3LOW

Key Information:

Vendor

Wofssl

Status
Wolfssl
Vendor
CVE Published:
21 November 2025

What is CVE-2025-11933?

An improper input validation issue exists in the parsing of the TLS 1.3 CKS extension within wolfSSL versions 5.8.2 and older. This vulnerability can be exploited by a remote unauthenticated attacker through a specially crafted ClientHello message that contains duplicate CKS extensions. If successfully executed, it may lead to a denial-of-service, potentially interrupting service for legitimate users.

Affected Version(s)

wolfSSL MacOS v5.8.2

References

https://github.com/wolfSSL/wolfssl
https://github.com/wolfSSL/wolfssl/pull/9132

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jaehun Lee, Pohang University of Science and Technology (POSTECH)
Kyungmin Bae, Pohang University of Science and Technology (POSTECH)
JSON
.
CVE-2025-11933 : Improper Input Validation in wolfSSL TLS 1.3 CKS Extension Parsing