CVE-2026-5479: wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag
In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSLEVPCipherFinal (and related EVP cipher finalization functions) fails to verify the authentication tag before returning plaintext to the caller. When an application uses the EVP API to perform ChaCha20-Poly1305 decryption, the implementation computes or accepts the tag but does not compare it against the expected value.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5479?
CVE-2026-5479 has been classified as a high-severity vulnerability due to its potential impact on the integrity and confidentiality of data.
How do I fix CVE-2026-5479?
To fix CVE-2026-5479, update to the latest version of wolfSSL that includes the patch addressing the failure to verify the authentication tag.
What type of vulnerability is CVE-2026-5479?
CVE-2026-5479 is a cryptographic vulnerability specifically affecting the AEAD decryption process of the ChaCha20-Poly1305 algorithm in wolfSSL.
What are the potential impacts of CVE-2026-5479?
The potential impacts of CVE-2026-5479 include unauthorized access to plaintext data, which can compromise the security of applications utilizing wolfSSL.
Who is affected by CVE-2026-5479?
CVE-2026-5479 affects all applications using wolfSSL's EVP layer that implement the ChaCha20-Poly1305 AEAD decryption without proper authentication tag verification.