DEBIAN-CVE-2026-6681

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-6681

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6681.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-6681

Upstream

CVE-2026-6681

Published

2026-06-25T21:16:28Z

Modified

2026-09-14T17:03:28Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release.

References

https://security-tracker.debian.org/tracker/CVE-2026-6681

Affected packages

Debian:12 / wolfssl

Package

Name: wolfssl
Purl: pkg:deb/debian/wolfssl?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.5.4-2+deb12u3

Affected versions

5.*

5.5.4-2

5.5.4-2+deb12u1

5.5.4-2+deb12u2

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6681.json"

Debian:13 / wolfssl