CVE-2026-6291: Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption
Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA PKCS#1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to submit crafted EnvelopedData messages and observe error responses could use this as a padding oracle to incrementally recover the encrypted Content Encryption Key (CEK). The fix generates a deterministic pseudo-random fake CEK on padding failure (via HMAC-SHA256) and proceeds with decryption identically, using constant-time operations throughout, so that all failure paths produce the same error regardless of padding validity.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6291?
CVE-2026-6291 has a medium severity rating of 6 according to the CVSS score.
How do I fix CVE-2026-6291?
To fix CVE-2026-6291, upgrade to the latest version of wolfSSL where the vulnerability has been addressed.
What does CVE-2026-6291 impact?
CVE-2026-6291 impacts systems using wolfSSL for PKCS#7 decryption with RSA PKCS#1 v1.5 key transport.
What type of attack does CVE-2026-6291 enable?
CVE-2026-6291 enables Bleichenbacher padding oracle attacks which exploit errors in RSA padding validation.
When was CVE-2026-6291 published?
CVE-2026-6291 was published on June 25, 2026.