Fallback Vulnerability in wolfSSL's Encryption Implementation
CVE-2026-6092

2.1LOW

Key Information:

Vendor

Wolfssl

Status
Wolfssl
Vendor
CVE Published:
25 June 2026

What is CVE-2026-6092?

A vulnerability has been identified in the encryption implementation of wolfSSL, specifically when the HAVE_ENCRYPT_THEN_MAC configuration is enabled. This issue arises when the implementation may fallback to a less secure MAC-then-Encrypt method instead of the intended Encrypt-then-MAC approach. Such behavior could lead to potential security implications by undermining the integrity of encrypted data. Users should take immediate action to review their configurations and apply the necessary updates.

Affected Version(s)

wolfSSL 5.2.0 <= 5.9.1

References

https://github.com/wolfSSL/wolfssl/pull/10167
patch
https://www.wolfssl.com/docs/security-vulnerabilities/

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcin Olejnik (Rockwell Automation)
.