CVE-2025-11935
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-12-03

Assigner: wolfSSL Inc.

Description
With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with the connection using PSK without PFS. This happened when a server responded to a ClientHello containing psk_dhe_ke without a key_share extension. The re-use of an authenticated PSK connection that on the clients side unexpectedly did not have PFS, reduces the security of the connection.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-21
Last Modified
2025-12-03
Generated
2026-06-16
AI Q&A
2025-11-22
EPSS Evaluated
2026-06-15
NVD
CVE-2025-11935
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
wolfssl wolfssl From 5.8.2 (inc) to 5.8.4 (exc)
apple macos *
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-326 The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs in TLS 1.3 when using pre-shared keys (PSK). A malicious or faulty server can ignore the client's request for perfect forward secrecy (PFS) by responding without the required key_share extension. As a result, the client continues the connection using PSK without PFS, which reduces the security of the connection by reusing an authenticated PSK connection that unexpectedly lacks PFS.

Impact Analysis

The vulnerability reduces the security of TLS 1.3 connections by allowing a server to bypass perfect forward secrecy when using pre-shared keys. This means that the confidentiality of past communications could be compromised if the PSK is later exposed, as the connection does not have the additional protection of PFS.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11935. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart