CVE-2026-5504
CVE-2026-5504 · PKCS7 CBC Padding Oracle — Plaintext Recovery
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated.
CVSS 6.3 · Medium · EPSS 0.1%
- Published
- Updated
Stack: system
Affected products and versions
wolfssl
- Versions
- ≥ 0, ≤ 5.9.0: Affected (semver)
No fix published
wolfssl Debian:12
- Versions
- 5.5.4-2
- 5.5.4-2+deb12u1
- 5.5.4-2+deb12u2
- 5.5.4-2+deb12u3
- 5.5.4-2.1
- 5.6.4-1
- 5.6.4-2
- 5.6.6-1
- 5.6.6-1.1
- 5.6.6-1.2
- 5.6.6-1.3
- 5.6.6-1.3~exp1
- 5.7.0-0.1
- 5.7.0-0.2
- 5.7.0-0.3
- 5.7.2-0.1
- 5.7.2-0.2
- 5.7.2-0.3
- 5.7.2-0.4
- 5.8.2-1
- 5.8.2-1.1
- 5.8.2-1.2
- 5.8.4-1
- 5.9.0-0.1
- 5.9.0-0.2
- 5.9.1-0.1
- 5.9.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Debian:13
- Versions
- 5.7.2-0.1
- 5.7.2-0.1+deb13u1
- 5.7.2-0.1+deb13u2
- 5.7.2-0.2
- 5.7.2-0.3
- 5.7.2-0.4
- 5.8.2-1
- 5.8.2-1.1
- 5.8.2-1.2
- 5.8.4-1
- 5.9.0-0.1
- 5.9.0-0.2
- 5.9.1-0.1
- 5.9.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:16.04:LTS
- Versions
- 3.4.8+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:18.04:LTS
- Versions
- 3.10.2+dfsg-2
- 3.12.0+dfsg-1
- 3.12.2+dfsg-1
- 3.13.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:20.04:LTS
- Versions
- 4.1.0+dfsg-2
- 4.2.0+dfsg-1
- 4.2.0+dfsg-2
- 4.2.0+dfsg-3
- 4.3.0+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:22.04:LTS
- Versions
- 4.6.0-3
- 5.0.0-1
- 5.1.1-1
- 5.2.0-1
- 5.2.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:24.04:LTS
- Versions
- 5.5.4-2
- 5.5.4-2.1
- 5.6.4-2
- 5.6.6-1.2
- 5.6.6-1.3
- 5.6.6-1.3build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:25.10
- Versions
- 5.7.2-0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:26.10
- Versions
- 5.9.1-0.1
- 5.9.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wolfssl Ubuntu:26.04:LTS
- Versions
- 5.7.2-0.1
- 5.8.2-1.2
- 5.8.4-1
- 5.9.1-0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published