CVE-2026-81535
- Source
- https://cve.org/CVERecord?id=CVE-2026-81535
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81535.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-81535
- Downstream
- Published
- 2026-10-07T02:39:27Z
- Modified
- 2026-10-28T11:12:27Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check
- Details
-
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.
- Database specific
{ "cna_assigner": "wolfSSL", "cwe_ids": [ "CWE-862", "CWE-863" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81535.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81535.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-81535
- https://github.com/wolfSSL/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8
- https://github.com/wolfSSL/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c
- https://github.com/wolfSSL/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c
- https://github.com/wolfSSL/wolfssh
Affected packages
Git / github.com/wolfssl/wolfssh
Affected ranges
- Type
- GIT
- Repo
- https://github.com/wolfssl/wolfssh
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.4.8" }, { "fixed": "1.6.0" } ], "source": "AFFECTED_FIELD", "strategy": "ChangesAt" }, { "range": [ { "fixed": "616eb681e70759c30c3ba158f2b18d7bd954def8" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "e396a0a4b6b367f10270287446a4be0071742b5c" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "79a7f299337a28aa561409688a268d0efe6e295c" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
v1.*
v1.4.10-stable
v1.4.11-stable
v1.4.12-stable
v1.4.13-stable
v1.4.14-stable
v1.4.15-stable
v1.4.16
v1.4.17-stable
v1.4.18-stable
v1.4.19-stable
v1.4.20-stable
v1.4.21-stable
v1.4.22-stable
v1.4.8-stable
v1.4.9
v1.5.0-stable
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81535.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"124913582256639328303235500919788647962",
"138637800997372105022902716047467197364",
"299387667209027144892665978507989380470",
"182658410593141693415847598377501099540",
"200083107938909423927579061047430839330",
"56336487295781888633976743369785188931",
"69890059083102045272734140601308006362",
"224079913856864772806598097932147172515",
"122525635720636762801555962137553731574",
"121498039599948439870958261333026793315",
"18656884677729943874756927575288018829",
"178421265204575374327643453305182571077",
"104461960183976824534721405474105294244",
"55652567131647869506750042801711764601",
"227771526984612726160382909066256740589",
"246030106236638993362592877342295848517",
"147901786036641824974379271195872537012",
"89979298752908118911319083750054014971"
],
"threshold": 0.9
},
"id": "CVE-2026-81535-03e605b0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "src/internal.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "11145144227088164029274513091045162055",
"length": 4923
},
"id": "CVE-2026-81535-04c95dde",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c",
"target": {
"file": "src/internal.c",
"function": "DoChannelOpen"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "150405140272355709157903087037623098939",
"length": 660
},
"id": "CVE-2026-81535-15b90cad",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c",
"target": {
"file": "tests/regress.c",
"function": "TestForwardedTcpipUntrackedClientUnchanged"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "320631759984865226973731877234373894915",
"length": 414
},
"id": "CVE-2026-81535-15d7b604",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "src/internal.c",
"function": "DoRequestSuccess"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "83845586828147555940074403833970324095",
"length": 245
},
"id": "CVE-2026-81535-193aa744",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "tests/regress.c",
"function": "MemIoInit"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"303659072568245580539697573219248761728",
"265484572000647316742745922463815164564",
"195901816485603830111865946949056759078",
"66844116792303038003826194822346137118",
"119475461034364403360148147236455577844",
"41590065051120989919454070538511495899",
"335890533260695573424096010765252259938",
"154812522298449303902919558740069229170",
"187494562312649821995259472339828483052",
"79098273582629307739267093388150655996",
"71674867650747278271992842379595434829",
"307926586942295220426112590423867403224",
"182605179196764410919580907675231880178",
"28981893728005148137867583215938310842",
"16931299900153056957867619880474319238"
],
"threshold": 0.9
},
"id": "CVE-2026-81535-24d8ec75",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "wolfssh/internal.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"254656214847721340833227245114666562377",
"286805086627067744062674159455675105663",
"157079696896795157309002043880353522002"
],
"threshold": 0.9
},
"id": "CVE-2026-81535-25a28298",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "tests/api.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "37149054697201195582682745336983423113",
"length": 1452
},
"id": "CVE-2026-81535-29f4dd2e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c",
"target": {
"file": "src/internal.c",
"function": "FwdPendingCommit"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "183430484661815080426721725988612146832",
"length": 408
},
"id": "CVE-2026-81535-3951ec69",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c",
"target": {
"file": "tests/regress.c",
"function": "TestForwardedTcpipFailedSendRegistersNothing"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"246138819652193211062189844068582625723",
"145031837744572074463081994771311704674",
"237701801494776740364638552104181421283",
"22729851609296805174192278919173960316"
],
"threshold": 0.9
},
"id": "CVE-2026-81535-4019fab8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c",
"target": {
"file": "wolfssh/internal.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "248330978952785400697315253683799332345",
"length": 4505
},
"id": "CVE-2026-81535-4c6bc6dd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "tests/regress.c",
"function": "main"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "160438405331652142748564430024026790689",
"length": 4572
},
"id": "CVE-2026-81535-4ddb8ccd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "src/internal.c",
"function": "DoChannelOpen"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "252478116871274937264300343151644710488",
"length": 2266
},
"id": "CVE-2026-81535-578794c0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8",
"target": {
"file": "tests/regress.c",
"function": "main"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "84491136557991867990096682814262351919",
"length": 324
},
"id": "CVE-2026-81535-5d46156f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "tests/regress.c",
"function": "MemSend"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "268671931678761062760521687367672393339",
"length": 5812
},
"id": "CVE-2026-81535-66555923",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c",
"target": {
"file": "tests/regress.c",
"function": "main"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "128487046548530092758625714886377587383",
"length": 3084
},
"id": "CVE-2026-81535-7e6dd933",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "src/internal.c",
"function": "SshResourceFree"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"134352958587497847154173948362032169167",
"58969277447908459971886754343162534316",
"302712303753684043573148664815025861236",
"119169611652365796826101443207983091454",
"187795314054619409703491825096427573078",
"332830714061829723957173680160535889860",
"138173155428538225351614414291349626063"
],
"threshold": 0.9
},
"id": "CVE-2026-81535-90684344",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8",
"target": {
"file": "tests/regress.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "217983627775472814970377627110386873852",
"length": 823
},
"id": "CVE-2026-81535-9895e0d4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "src/ssh.c",
"function": "wolfSSH_FwdRemoteSetup"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "213679545520114635811698493948806838389",
"length": 221
},
"id": "CVE-2026-81535-9ea43a87",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c",
"target": {
"file": "tests/regress.c",
"function": "InboundOpenDuringSendHighwaterCb"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "179583439593972303058976734922020142720",
"length": 414
},
"id": "CVE-2026-81535-a4cd05f5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "src/internal.c",
"function": "DoRequestFailure"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"207436235493976501800805755566142171291",
"48691223686980090244458540894041380246",
"85056554911650629737698951440816979374",
"236495941019012533189587157985621991702",
"183471587563319347683699265977454190403",
"72314076490732936614209703569299180913",
"67512597054479668231403823857707228467",
"57079770123833063231058483023256392102",
"77719657348854599086302120993349979030",
"225931979271912300308858340535522009543",
"284375827340140102914767959546728205926",
"18933772487687389848720353206707435131",
"172692377773495303346367977476486718384",
"318138294186127190650287047562410603179",
"15295870135700915065100823744394065406",
"143246071230199474046898646762369169484",
"331311112629528412033300453438400103178",
"24210921038511765253335466848753700263",
"163885481211226272947116970758545345977",
"26303109655177880833730862281013083231",
"314814093771378786405599764503445702419",
"234648408953119650757228665383650303656",
"218897433888443070462543897452656646660",
"92292995500879522983376859506115800486",
"175403104321876036836268384094406927789",
"80223729625305262392344908786356271007",
"17166984244841361230019534345446150046",
"258102186405428215793986445015942091075",
"196149885536704767294602574258639326437",
"24210921038511765253335466848753700263",
"304272433367913707068199801073371360012",
"63175895227654445411224019286083027438",
"82391933201223408575483188040964405709",
"159304063136516780413155708189864695899",
"125154523043902673900103909983690462633"
],
"threshold": 0.9
},
"id": "CVE-2026-81535-a5f03942",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "src/ssh.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "8779544054909373954596820805374172361",
"length": 517
},
"id": "CVE-2026-81535-afe9bf7a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c",
"target": {
"file": "tests/regress.c",
"function": "TestForwardedTcpipFailedSendDiscardsAnsweredSlot"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155717767262454882200766609287165923163",
"57463512720334291115398291090608541664",
"156815549073999042193475014492435003563",
"221272597797263793725939541385070586220",
"178201758160682253048684011909770950663",
"73045775810119405829056343818768712506",
"66115383946414117698750262499453676630",
"55677795040342601932003668726481845032",
"4781490072085543487930179480997888683",
"92592744043033126872970220470938921190",
"11654856040491384284150238431011243064",
"110346773052626324408653323342250150103",
"237396765517050408622505645360705236160",
"99786832445309511098429988247283017261",
"62800779306874715905435971290414297216",
"92820300043245828396619806467516045824",
"121402584207823594513335202102028260649",
"217388353625149306612696244288250248579",
"308349198861457421006164604086950350209",
"211525939392981303566312311943486987237",
"205409466472092158743298344415939637839",
"222391929115953814121367922588143420987",
"146465695104165517311472682480953568601",
"118968151331546469659476733070858210241",
"313629415469117403305592684199955208976",
"275388503520330082958231955131952393965",
"166077475376595918916044194509950108403",
"335739912079226899844812991210525406727",
"172229959746000846746343427421558176866",
"339341396683460849007782553786275469826",
"66102750702499335509621398930700508417",
"183891073829277552629429065561091969069",
"178183317188227602052120784868599174524",
"234068950979760748186751735596430372920",
"275992231221046504263640323969039333283",
"207254499302276021339536534098405727103",
"153994743519568866943482157152627313083",
"213202014812262586049245639115647978975",
"155826344079648809811690539240162118588",
"108707193988758568868321106858553484280",
"89400503114634284979495299687883864860",
"32895936442507640506273081687087636910",
"147352800129916431070338424486983922466",
"177558542195595686795423463223914899639",
"117340304908257086915531175048503517258",
"293490855439495151839993607055768309772",
"44237183836472909818652761705418897928",
"249467911250584200908399287031465973328",
"331223835819533635284212418757825635492",
"237662506413928671947326015554693101673",
"270777460026667369308296693402216571926",
"257959737996397055279282037023009231925",
"237336460319019589298442038717413789742",
"248967189655191381645855494804526865343",
"35388703110297909651470351770547659600",
"329726885662564620222603727986094246210",
"72237036394612738593465268376366750908",
"17163709096019338784448584061947722662",
"42845351916838413028996511817331303196",
"226012354958947507642087629880519683166",
"236293117116614327084389090140088425021",
"179997528892722411069166504385869497209",
"2977758559520169060149365094636994039",
"54304331048561668213338280092537819011",
"86084474884879650419034562966271123354",
"227047621161331537772270680367966738252",
"320094230493724873185837205664255944047",
"261581721882908137219499238376727358486",
"33416399433521381601954775582992998705",
"18325922756393291854710827532554064880"
],
"threshold": 0.9
},
"id": "CVE-2026-81535-bd6c7476",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "tests/regress.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"30009327039219374679474340705188740222",
"179630503361469559095127431939978752482",
"21776100741355414541040074743226772690",
"245707726334883169299981618568878676667",
"199315344942093628748211478572159582451",
"307271673698560659173888880662422103278",
"1794136181705122120569573069430656442",
"123905708831262885329008859147656478290",
"213939417497259687159308600050917807708",
"255331789840243550832641402428538432456",
"97118941227331436419556614358615295715",
"194848855470673110239793031865123139592",
"283968729401064329862306471627239900353",
"125559877735738031274546539195616142520",
"287863937184014174576003425559248678747",
"10508954161321971231538438880202687717",
"277842418041181287360219868099371282046",
"213596395647609561660407111719082595496",
"229076595435785324262278036603887397325",
"19923194218924453294541103079366843435",
"329206932696853215069919556062709267068",
"117194625572885800068363087889489941606",
"282672993796397180112012269983756464238",
"23526331237483397129540874964639401090",
"130220455454812471384193081334971796231",
"338198081421108275037311326148503490605",
"168469142129832710789468463796200071921"
],
"threshold": 0.9
},
"id": "CVE-2026-81535-bd9069ee",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c",
"target": {
"file": "tests/regress.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"9215871509839009648085008832273383402",
"332321449558763343871219671715855527775",
"254277667562589009936705101045503876753",
"109437783001656667959702640237257740865",
"214203737787612817587331657129842368415",
"42240806652895123055570906084034371123",
"5310842151418918089651937576914541023",
"188644226940072707013544768342453836093",
"239076716342396835342743479854581857931",
"234593375723157184671560455729188765914",
"293905837443031991680881911892545290360",
"49619014756062831607908694179463682956",
"178280347931141923635046131432757496266",
"262080074669364525933644989645393714418",
"277733536934032589062886899162761562348",
"211587638486442602693399998660853586402",
"47023910967551408113845248223162935297",
"327984290658832813664038638472946575755",
"62623191143947015440419066053863387098",
"268000935814588449002946782218350373450",
"323536761494894513130751608018469629715",
"1047614070993500691338561074631033436",
"227771526984612726160382909066256740589"
],
"threshold": 0.9
},
"id": "CVE-2026-81535-bfda99f8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8",
"target": {
"file": "src/internal.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "315407234197210217218995362808928367896",
"length": 4110
},
"id": "CVE-2026-81535-cb5c157e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8",
"target": {
"file": "src/internal.c",
"function": "DoChannelOpen"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"105429088287490077927028845912597999077",
"285536277255140552562752921053171216700",
"39326912221159376265159731303276855581",
"170841613209429523087702736565003289603",
"153668437694101276383621226245377153089",
"252795045354047582691229829043571529656",
"17688492765845262335187920960239193547",
"49840232472635408765248131681092212111",
"319126315770518852561857366241214113749"
],
"threshold": 0.9
},
"id": "CVE-2026-81535-cd9f811d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c",
"target": {
"file": "src/internal.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "95307796858565009053511948953534356718",
"length": 478
},
"id": "CVE-2026-81535-cf7d3031",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c",
"target": {
"file": "tests/regress.c",
"function": "RunForwardedTcpipPostSendErrorTest"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "139630656175214904068623806982056798076",
"length": 388
},
"id": "CVE-2026-81535-d91c8da0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "src/ssh.c",
"function": "wolfSSH_global_request"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "251917520121089905325859079297958235940",
"length": 1149
},
"id": "CVE-2026-81535-eb459be6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "tests/api.c",
"function": "test_wolfSSH_FwdRemote_badArgs"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "209331068716325010536970814583451256359",
"length": 843
},
"id": "CVE-2026-81535-ee4f2dd5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/wolfssl/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c",
"target": {
"file": "src/ssh.c",
"function": "wolfSSH_FwdRemoteCancel"
}
}
]
vanir_signatures_modified
"2026-10-28T11:12:27Z"