CVE-2025-11935 Details
Description
With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with the connection using PSK without PFS. This happened when a server responded to a ClientHello containing psk_dhe_ke without a key_share extension. The re-use of an authenticated PSK connection that on the clients side unexpectedly did not have PFS, reduces the security of the connection.
A vulnerability exists in wolfSSL's handling of pre-shared key (PSK) connections in TLS 1.3, specifically in versions through 5.8.4. A malicious or faulty server could disregard the client's request for perfect forward secrecy (PFS), allowing the connection to proceed using PSK without PFS. This issue arises when the server responds to a ClientHello that includes psk_dhe_ke with a ServerHello that lacks a key_share extension. The result is a connection that unexpectedly lacks PFS, compromising its security.
This vulnerability has been fixed in wolfSSL version 5.8.4. Users should update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 25, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wolfSSL/wolfssl | [email protected] | Product |
| https://github.com/wolfSSL/wolfssl/pull/9112 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-326 | Inadequate Encryption Strength | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wolfssl wolfssl | >= 5.8.2, < 5.8.4 |
CPE
Remediation
| |
| apple macos | All versions |
CPE
Remediation
| |
| linux linux kernel | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 3, 2025 | Initial Analysis | [email protected] |
| Nov 21, 2025 | New CVE Received | [email protected] |