CVE-2026-6331Disclosure(wolfssl / wolfssl)

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC verify path the supplied signature length was only checked as not exceeding the MAC length, so a zero-length or otherwise truncated tag could pass verification. The fix requires the supplied tag length to exactly equal the MAC length and rejects a zero-length MAC, so a forged short or empty tag is no longer accepted.

wolfssl CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/wolfSSL/wolfssl/pull/10192

Vendor / third-party advisories

https://www.wolfssl.com/docs/security-vulnerabilities/

Weakness type (CWE)

CWE-347

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

wolfssl

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

wolfssl

Products

wolfssl

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-6331 HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC ve… https://www.cve.org/CVERecord?id=CVE-2026-6331 ----- Traducción: CVE-2026-6331 Fal… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑6331, detailing a zero‑length tag forgery vulnerability in OpenSSL’s HMAC verification but provides no PoC, exploit tool, exploitation evidence, or patch information.
0000027
89 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-6331 HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC verification. In the OpenSSL-compatibility HMAC ve… https://www.cve.org/CVERecord?id=CVE-2026-6331
Post summary
The content provides a brief disclosure of CVE‑2026‑6331, describing a zero‑length HMAC tag forgery in OpenSSL's EVP_DigestVerifyFinal, with no PoC, exploit, or patch information presented.
00000700
57.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wolfssl	wolfssl	-	-	-

Explore more

Back to dashboard wolfssl CVEs wolfssl vulnerabilities