Vulnerability in wolfSSH Affects Unauthenticated TCP/IP Forwarding Operations

CVE-2026-81535

What is CVE-2026-81535?

A flaw in wolfSSH allows unauthorized forwarding of TCP/IP channels due to insufficient authorization checks on forwarded-tcpip opens. When built with the --enable-fwd option, the DoChannelOpen() function is improperly configured, leading to potential exploitation by malicious SSH peers. By bypassing established forwarding policies, a compromised server can allocate an unbounded number of per-channel buffers without client consent. This oversight not only jeopardizes the integrity of the SSH connection but also opens the door for unauthorized data routing to arbitrary destinations, presenting significant security risks.

References