CVE-2025-11933
BaseFortify
Publication date: 2025-11-21
Last updated on: 2025-12-03
Assigner: wolfSSL Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wolfssl | wolfssl | From 5.8.2 (inc) to 5.8.4 (exc) |
| apple | macos | * |
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper input validation issue in the TLS 1.3 CKS extension parsing in wolfSSL version 5.8.2 and earlier. It allows a remote unauthenticated attacker to potentially cause a denial-of-service (DoS) by sending a specially crafted ClientHello message containing duplicate CKS extensions.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing a remote attacker to cause a denial-of-service condition on your system or application using wolfSSL 5.8.2 or earlier. This could lead to service interruptions or crashes when processing TLS 1.3 connections with malicious ClientHello messages.