BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-12-03

Assigner: wolfSSL Inc.

Description

With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with the connection using PSK without PFS. This happened when a server responded to a ClientHello containing psk_dhe_ke without a key_share extension. The re-use of an authenticated PSK connection that on the clients side unexpectedly did not have PFS, reduces the security of the connection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-21

Last Modified

2025-12-03

Generated

2026-07-06

AI Q&A

2025-11-22

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11935

Affected Vendors & Products

Vendor	Product	Version / Range
wolfssl	wolfssl	From 5.8.2 (inc) to 5.8.4 (exc)
apple	macos	*
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-326	The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in TLS 1.3 when using pre-shared keys (PSK). A malicious or faulty server can ignore the client's request for perfect forward secrecy (PFS) by responding without the required key_share extension. As a result, the client continues the connection using PSK without PFS, which reduces the security of the connection by reusing an authenticated PSK connection that unexpectedly lacks PFS.

Impact Analysis

The vulnerability reduces the security of TLS 1.3 connections by allowing a server to bypass perfect forward secrecy when using pre-shared keys. This means that the confidentiality of past communications could be compromised if the PSK is later exposed, as the connection does not have the additional protection of PFS.

Hi! I’m here to help you understand CVE-2025-11935. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70