CVE-2026-16516

wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key).

• CWE-345

• https://github.com/wolfSSL/wolfssh/commit/31d13697a608fa1bf9eec11aa6eff1503ade836f
• https://github.com/wolfSSL/wolfssh/issues/1012

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Awaiting Analysis

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16504Deployment of the VPS.org one-click Zulip template deploys a…9.8
• CVE-2026-1651The Email Subscribers by Icegram Express plugin for WordPres…6.5
• CVE-2026-16512gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dere…3.1
• CVE-2026-16513The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles()…7.8
• CVE-2026-16514gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gp…4.3
• CVE-2026-16515net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemente…4.7
• CVE-2026-16517A signed integer overflow vulnerability was found in libarch…2.9
• CVE-2026-16519A DLL hijacking vulnerability exists in the GeoVision GV-IP …7.3
• CVE-2026-1652A potential buffer overflow vulnerability was reported in th…6.1
• CVE-2026-16520Improper input validation and Exposure of sensitive informat…8.7
• CVE-2026-16524A command injection flaw in PCP's linux_sockets PMDA allows …7.8
• CVE-2026-16526A flaw in the PCP linux_sockets module exposes an unsecured …8.8