CVE-2026-5504
PKCS7 CBC Padding Oracle — Plaintext Recovery
- State
- Published
- Severity
- 6.3 Medium
- Published
- Apr 9, 2026
- Updated
- Apr 14, 2026
- Reserved
- Apr 3, 2026
Description
A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | wolfSSL |
Weaknesses
- CWE-354 Improper validation of integrity check value
Affected Products
| Product | Versions |
|---|---|
wolfSSLwolfSSL |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.