CVE-2026-6330

Katalog CVE

CVSS 6.5 · Medium EPSS 0,17%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada wolfssl. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating party could fail to detect a manipulated ciphertext and proceed without the standard's required implicit rejection.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

27 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wolfssl.com/docs/security-vulnerabilities/ advisory vendor
• https://github.com/wolfSSL/wolfssl/pull/10192 issue tracking · patch