CVE-2026-16516
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches…
- Risk score
- 50/100
- CVSS
- 7.4 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->…
- Affected
- Wolfssh
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Wolfssh: Amber, patch this week. In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbou…
The flaws
- CVE-2026-16516: WolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches… (CVSS 7.4 · EPSS 0%)
- CVE-2026-81535: Missing authorisation (CVSS 9.1 · EPSS 0%)
- CVE-2026-83742: Stack buffer overflow can lead to denial of service (CVSS 8.8 · EPSS 0%)
- CVE-2026-83540: Authentication bypass (CVSS 8.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Wolfssh
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-345 (CWE-345). 45 other warnings in 30 days
- Same product: Earlier Wolfssh warnings. 1 in the last 90 days
Why it is Yellow
- CVSS 7.4 high
- Remotely exploitable without logging in
References
Original description
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key).
Last activity 7 Oct 2026. Patch Forecast updates every hour.