Padding Oracle Vulnerability in wolfSSL's PKCS7 CBC Decryption
CVE-2026-5504

6.3MEDIUM

Key Information:

Vendor

Wolfssl

Status
Wolfssl
Vendor
CVE Published:
9 April 2026

What is CVE-2026-5504?

The vulnerability in wolfSSL's PKCS7 CBC decryption mechanism arises from improper validation of padding bytes in earlier versions. An attacker can exploit this flaw by conducting repeated decryption queries with altered ciphertext, potentially recovering sensitive plaintext data. This weakness highlights the importance of proper padding validation in cryptographic implementations.

Affected Version(s)

wolfSSL 0 <= 5.9.0

References

https://github.com/wolfSSL/wolfssl/pull/10088

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sunwoo Lee of Korea Institute of Energy Technology (KENTECH) for the report.
Woohyun Choi of Korea Institute of Energy Technology (KENTECH) for the report.
Seunghyun Yoon of Korea Institute of Energy Technology (KENTECH) for the report.
.