CVE-2026-5504: PKCS7 CBC Padding Oracle — Plaintext Recovery
A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5504?
CVE-2026-5504 has a moderate severity rating due to potential plaintext recovery through padding oracle attacks.
How do I fix CVE-2026-5504?
To fix CVE-2026-5504, update wolfSSL to the latest version where interior padding validation has been implemented.
Which versions of wolfSSL are affected by CVE-2026-5504?
CVE-2026-5504 affects previous versions of wolfSSL prior to the implementation of padding byte validation.
What are the consequences of not addressing CVE-2026-5504?
Not addressing CVE-2026-5504 could allow attackers to recover sensitive plaintext data from the encrypted messages.
How does CVE-2026-5504 exploit PKCS7 CBC decryption?
CVE-2026-5504 exploits PKCS7 CBC decryption by leveraging a padding oracle vulnerability through repeated decryption queries with modified ciphertext.