CVE-2026-6329— wolfSSL 加密问题漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing Application新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-6329の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
PKCS#12 MAC verification uses attacker-controlled comparison length
ソース: NVD (National Vulnerability Database)
脆弱性説明
PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted. The PKCS#12 verify path compared the locally computed HMAC against the MAC parsed from the PKCS#12 structure using a length taken directly from the attacker-supplied input, without first verifying that it equals the length of the digest actually produced by the configured algorithm. A truncated or zero-length stored MAC could therefore be accepted, defeating the integrity protection of the MAC.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
密码学签名的验证不恰当
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
wolfSSL 加密问题漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
wolfSSL是wolfSSL公司开源的一个针对嵌入式系统开发人员使用的小的、可移植的嵌入式SSL编程库。 wolfSSL 3.10.0版本至5.9.1版本存在加密问题漏洞，该漏洞源于PKCS#12 MAC验证使用攻击者控制的比较长度，可能接受截断或零长度的MAC，削弱MAC完整性检查。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-6329の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-6329のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-6329 补丁与修复 (1)
CVE-2026-6329 厂商页面 (1)
Same Patch Batch · wolfSSL · 2026-06-25 · 32 CVEs total
| CVE-2026-6679 | DTLS 1.3 ACK serialization heap buffer overflow via integer truncation | |
| CVE-2026-55958 | Renesas TSIP TLS 1.3 transcript buffer out-of-bounds write in tsip_StoreMessage | |
| CVE-2026-55960 | Un-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain valida | |
| CVE-2026-55967 | AES-GCM streaming APIs do not reject >64 GiB cumulative single messages, enabling counter | |
| CVE-2026-55961 | wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer | |
| CVE-2026-55962 | TLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/ | |
| CVE-2026-55964 | Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exem | |
| CVE-2026-8720 | HMAC-BLAKE2 final discards message when key length exceeds block size | |
| CVE-2026-12340 | Out-of-bounds heap read in SM2/SM3 certificate Subject Key Identifier computation | |
| CVE-2026-10512 | X25519 x86_64 assembly final reduction leaves non-canonical field element | |
| CVE-2026-10097 | ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static p | |
| CVE-2026-10098 | OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status | |
| CVE-2026-10592 | Wildcard DNS SAN bypasses CA name-constraint checks | |
| CVE-2026-11310 | X.509 trust-chain bypass in wolfSSL_X509_verify_cert() via untrusted intermediate anchorin | |
| CVE-2026-11703 | Missing SNI/ALPN binding on stateful (session-ID) TLS session resumption | |
| CVE-2026-11999 | X.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert() | |
| CVE-2026-7532 | iPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined | |
| CVE-2026-6094 | Heap buffer overread in wc_PKCS7_DecodeEnvelopedData parsing crafted PKCS7 EnvelopedData | |
| CVE-2026-6731 | X.509 name constraint bypass via Subject CN treated as a DNS name | |
| CVE-2026-6325 | Out-of-bounds write in SetSuitesHashSigAlgo on oversized signature algorithms list |
Showing 20 of 32 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: wolfSSL
- CVE-2026-7511
PKCS7_verify signer confusion allows forged signatures to be - CVE-2026-7532
iPAddress name constraints not enforced when WOLFSSL_IP_ALT_ - CVE-2026-8720
HMAC-BLAKE2 final discards message when key length exceeds b - CVE-2026-10098
OCSP CertID serial-number length-confusion in wolfSSL_OCSP_r - CVE-2026-11703
Missing SNI/ALPN binding on stateful (session-ID) TLS sessio
同じベンダー: wolfSSL
- CVE-2026-7511
PKCS7_verify signer confusion allows forged signatures to be - CVE-2026-7532
iPAddress name constraints not enforced when WOLFSSL_IP_ALT_ - CVE-2026-8720
HMAC-BLAKE2 final discards message when key length exceeds b - CVE-2026-10098
OCSP CertID serial-number length-confusion in wolfSSL_OCSP_r - CVE-2026-11703
Missing SNI/ALPN binding on stateful (session-ID) TLS sessio
同じ弱点: CWE-347
- CVE-2026-9027
CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthentic - CVE-2026-54773
CoreWCF: WS-Security signature substitution via document-wid - CVE-2026-46354
Coder: PKCS#7 signature bypass in Azure instance identity al - CVE-2026-11348
Authentication Bypass in HAVELSAN's Open Source Project Lima - CVE-2026-58426
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows
V. CVE-2026-6329へのコメント
まだコメントはありません