CVE-2025-11934
Last modified
CVE-2025-11934 is a low-severity vulnerability rated 2.7/10 on the CVSS scale. Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for downgrading the signature algorithm used. For example when a client sends ECDSA P521 as the supported signature algorithm the server previously could respond as ECDSA P256 being the accepted signature algorithm and the connection would continue with using ECDSA P256, if the client supports ECDSA P256.. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for downgrading the signature algorithm used. For example when a client sends ECDSA P521 as the supported signature algorithm the server previously could respond as ECDSA P256 being the accepted signature algorithm and the connection would continue with using ECDSA P256, if the client supports ECDSA P256.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wolfssl | Wolfssl | >= 5.8.2, < 5.8.4 |
References
- https://github.com/wolfSSL/wolfssl/pull/9113Issue Tracking, Patch
- https://github.com/wolfSSL/wolfssl/pull/9113Issue Tracking, Patch
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-11934?
How severe is CVE-2025-11934?
How do I fix CVE-2025-11934?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-11927The Flying Images: Optimize and Lazy Load Images for Faster …4.4
- CVE-2025-11928The CSS & JavaScript Toolbox plugin for WordPress is vulnera…4.4
- CVE-2025-1193Improper host validation in the certificate validation compo…8.1
- CVE-2025-11931Integer Underflow Leads to Out-of-Bounds Access in XChaCha20…8.2
- CVE-2025-11932The server previously verified the TLS 1.3 PSK binder using …4.3
- CVE-2025-11933Improper Input Validation in the TLS 1.3 CKS extension parsi…6.5
- CVE-2025-11935With TLS 1.3 pre-shared key (PSK) a malicious or faulty serv…7.5
- CVE-2025-11936Improper input validation in the TLS 1.3 KeyShareEntry parsi…5.3
- CVE-2025-11937Improper Neutralization of Input During Web Page Generation …6.9
- CVE-2025-11938A vulnerability was found in ChurchCRM up to 5.18.0. This vu…8.1
- CVE-2025-11939A vulnerability was determined in ChurchCRM up to 5.18.0. Th…7.2
- CVE-2025-1194A Regular Expression Denial of Service (ReDoS) vulnerability…6.5
Are you affected by CVE-2025-11934?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST