p PatchFirst

CVE-2025-11933

CVE-2025-11933 · DoS Vulnerability in wolfSSL TLS 1.3 CKS Extension

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a denial-of-service via a crafted ClientHello message with duplicate CKS extensions.

CVSS 2.3 · Low · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • wolfssl

    Versions
    • ≥ 3.12.0, < 5.8.4: Affected (git)

    Update to 5.8.4

  • wolfssl Debian:12

    Versions
    • 5.5.4-2
    • 5.5.4-2+deb12u1
    • 5.5.4-2+deb12u2
    • 5.5.4-2+deb12u3
    • 5.5.4-2.1
    • 5.6.4-1
    • 5.6.4-2
    • 5.6.6-1
    • 5.6.6-1.1
    • 5.6.6-1.2
    • 5.6.6-1.3
    • 5.6.6-1.3~exp1
    • 5.7.0-0.1
    • 5.7.0-0.2
    • 5.7.0-0.3
    • 5.7.2-0.1
    • 5.7.2-0.2
    • 5.7.2-0.3
    • 5.7.2-0.4
    • 5.8.2-1
    • 5.8.2-1.1
    • 5.8.2-1.2
    • 5.8.4-1
    • 5.9.0-0.1
    • 5.9.0-0.2
    • 5.9.1-0.1
    • 5.9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wolfssl Debian:13

    Versions
    • 5.7.2-0.1
    • 5.7.2-0.1+deb13u1
    • 5.7.2-0.1+deb13u2
    • 5.7.2-0.2
    • 5.7.2-0.3
    • 5.7.2-0.4
    • 5.8.2-1
    • 5.8.2-1.1
    • 5.8.2-1.2
    • 5.8.4-1
    • 5.9.0-0.1
    • 5.9.0-0.2
    • 5.9.1-0.1
    • 5.9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wolfssl Ubuntu:16.04:LTS

    Versions
    • 3.4.8+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wolfssl Ubuntu:18.04:LTS

    Versions
    • 3.10.2+dfsg-2
    • 3.12.0+dfsg-1
    • 3.12.2+dfsg-1
    • 3.13.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wolfssl Ubuntu:20.04:LTS

    Versions
    • 4.1.0+dfsg-2
    • 4.2.0+dfsg-1
    • 4.2.0+dfsg-2
    • 4.2.0+dfsg-3
    • 4.3.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wolfssl Ubuntu:22.04:LTS

    Versions
    • 4.6.0-3
    • 5.0.0-1
    • 5.1.1-1
    • 5.2.0-1
    • 5.2.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wolfssl Ubuntu:24.04:LTS

    Versions
    • 5.5.4-2
    • 5.5.4-2.1
    • 5.6.4-2
    • 5.6.6-1.2
    • 5.6.6-1.3
    • 5.6.6-1.3build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wolfssl Ubuntu:25.10

    Versions
    • 5.7.2-0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wolfssl Ubuntu:26.10

    Versions
    • 5.9.1-0.1
    • 5.9.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wolfssl Ubuntu:26.04:LTS

    Versions
    • 5.7.2-0.1
    • 5.8.2-1.2
    • 5.8.4-1
    • 5.9.1-0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →