CVE-2026-6291 Details
Description
Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA PKCS#1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to submit crafted EnvelopedData messages and observe error responses could use this as a padding oracle to incrementally recover the encrypted Content Encryption Key (CEK). The fix generates a deterministic pseudo-random fake CEK on padding failure (via HMAC-SHA256) and proceeds with decryption identically, using constant-time operations throughout, so that all failure paths produce the same error regardless of padding validity.
A padding oracle vulnerability has been identified in wolfSSL's PKCS#7 KTRI decryption process. This issue arises when decrypting PKCS#7 EnvelopedData using RSA PKCS#1 v1.5 key transport. wolfSSL improperly distinguishes error responses based on the nature of the RSA padding validation, creating a timing discrepancy. An attacker who can send crafted EnvelopedData messages and analyze the error responses could exploit this vulnerability to incrementally recover the encrypted Content Encryption Key (CEK).
Users are advised to update to wolfSSL version 5.9.1, where this vulnerability has been fixed. The update includes a constant-time decryption process that standardizes error responses, regardless of padding validity, and introduces a deterministic pseudo-random fake CEK on padding failures.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wolfSSL/wolfssl/pull/10203 | [email protected] | Issue Tracking |
| https://www.wolfssl.com/docs/security-vulnerabilities/ | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-208 | Observable Timing Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wolfssl wolfssl | >= 3.9.10, < 5.9.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |