TI-2026-68939 Aliases CVE-2026-16516 GHSA-c487-h25j-24jq

Missing ECDSA curve check in wolfSSH host key handling

LOW 38CWE-345Published 2026-10-07 · Updated 2026-10-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

wolfSSH through 1.5.0 does not check that the ECDSA curve in a host key blob matches the algorithm negotiated during key exchange (CWE-345). An active network man-in-the-middle attacker can substitute a host key on a different ECDSA curve, and the client imports it on the wrong curve while signature verification still passes. The attack requires an active man-in-the-middle position and a lax public key check callback.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00191 8th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
wolfSSL	wolfSSH	up to 1.5.0	—	No fix listed	CNA

wolfSSH VendorwolfSSL Affected up to 1.5.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wolfssh:wolfssh::::::::	before 1.6.0	Vulnerable	wolfSSH

cpe:2.3:a:wolfssh:wolfssh:*:*:*:*:*:*:*:* Versions before 1.6.0 Vulnerable ·wolfSSH

Remediation

No fixed version is listed for wolfSSH.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-07 Threatist record created from CVE-2026-16516
2026-10-07 Alias added: GHSA-c487-h25j-24jq
2026-10-07 CISA SSVC decision points changed
2026-10-07 Priority changed: MEDIUM → LOW
2026-10-13 CVSS score added · NVD

References

Patch 1

https://github.com/wolfSSL/wolfssh/commit/31d13697a608fa1bf9eec11aa6eff1503ade836f

Advisory 1

ECDSA host key curve substitution - blob curve not validated against negotiated algorithm

TI-2024-00830 SEGV and out of bounds memory read from malicious packet CVSS 3.1CRITICAL 9.1
TI-2009-04246 Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp… CVSS 2.0HIGH 7.5
TI-2022-18557 In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3… CVSS 3.1HIGH 7.5
TI-2025-10943 Potential DoS Vulnerability through Multiple KeyShareEntry with Same Group in TLS 1.3 ClientHello CVSS 4.0MEDIUM 6.3
TI-2017-09737 wolfSSL Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
TI-2019-08902 wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity… CVSS 3.1CRITICAL 9.8

See all 176 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences