CVE-2026-5479

N/A

Description

In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSL_EVP_CipherFinal (and related EVP cipher finalization functions) fails to verify the authentication tag before returning plaintext to the caller. When an application uses the EVP API to perform ChaCha20-Poly1305 decryption, the implementation computes or accepts the tag but does not compare it against the expected value.

CVE Details

CVSS v3.1 ScoreN/A

Published4/10/2026

Last Modified4/13/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-354

References

https://github.com/wolfSSL/wolfssl/pull/10102(facts@wolfssl.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.