CVE-2025-11933: DoS Vulnerability in wolfSSL TLS 1.3 CKS Extension
Published Nov 21, 2025
·Updated
DoS Vulnerability in wolfSSL TLS 1.3 CKS Extension
Other sources
Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a denial-of-service via a crafted ClientHello message with duplicate CKS extensions.
— MITRE
Affected Software
4 affected components
wolfSSL wolfssl<=5.8.2
All of the following
wolfSSL wolfssl>=5.8.2<5.8.4
Any of the following
Apple macOS
Linux Linux kernel
Remediation
Patch Available
Event History
Nov 21, 2025
CVE Published
via MITRE·10:19 PM
Data Sourced
via MITRE·10:19 PM
DescriptionWeakness
Data Sourced
via NVD·11:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Nov 25, 2025
Data Sourced
via Microsoft·01:02 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-11933?
CVE-2025-11933 has been classified as a potential denial-of-service vulnerability.
2
How do I fix CVE-2025-11933?
To mitigate CVE-2025-11933, upgrade wolfSSL to version 5.8.3 or later where the vulnerability is resolved.
3
Which versions of wolfSSL are affected by CVE-2025-11933?
CVE-2025-11933 affects wolfSSL versions 5.8.2 and earlier.
4
Can CVE-2025-11933 be exploited remotely?
Yes, CVE-2025-11933 can be exploited by a remote unauthenticated attacker.
5
What type of attack does CVE-2025-11933 allow?
CVE-2025-11933 allows an attacker to potentially cause a denial-of-service via a crafted ClientHello message.