CVE-2025-11936CWE-20

CVE-2025-11936

Medium · published November 22, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a denial-of-service by sending a crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group, leading to excessive CPU and memory consumption during ClientHello processing.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00457 · 38.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-11-22T04:15Z
Affected products (1)
ProductVersionsFixed in
wolfssl/wolfssl≥ 5.8.2, < 5.8.45.8.4
References (3)
https://github.com/wolfSSL/wolfssl · [email protected]https://github.com/wolfSSL/wolfssl/pull/9117 · [email protected]https://github.com/wolfSSL/wolfssl/pull/9117 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 21 NOV 22:24Z
    Potential DoS Vulnerability through Multiple KeyShareEntry with Same Group in TLS 1.3 ClientHello
    cvelistv5