BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-12-03

Assigner: wolfSSL Inc.

Description

Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a denial-of-service by sending a crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group, leading to excessive CPU and memory consumption during ClientHello processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-21

Last Modified

2025-12-03

Generated

2026-07-06

AI Q&A

2025-11-22

EPSS Evaluated

2026-07-04

NVD

CVE-2025-11936

Affected Vendors & Products

Vendor	Product	Version / Range
wolfssl	wolfssl	From 5.8.2 (inc) to 5.8.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability is caused by improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL version 5.8.2. A remote unauthenticated attacker can send a specially crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group. This causes excessive CPU and memory consumption during the processing of the ClientHello message, leading to a denial-of-service condition.

Impact Analysis

The vulnerability can lead to a denial-of-service (DoS) attack, where an attacker remotely causes the affected system to consume excessive CPU and memory resources. This can degrade system performance or cause the system to become unresponsive, potentially disrupting services relying on wolfSSL TLS 1.3 implementations.

Hi! I’m here to help you understand CVE-2025-11936. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70