CVE-2026-5504CWE-354

PKCS7 CBC Padding Oracle — Plaintext Recovery

Medium · published April 9, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
3.8
In the wild
Unconfirmed
What it is

A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00149 · 3.8th percentile
Weakness
CWE-354 · Improper Validation of Integrity Check Value
Published
2026-04-09T22:33Z
EPSS history
Timeline
  • 09 APR 22:33Z
    PKCS7 CBC Padding Oracle — Plaintext Recovery
    cvelistv5