CVE-2026-5504
PKCS7 CBC Padding Oracle — Plaintext Recovery
Summary
PKCS7 CBC Padding Oracle — Plaintext Recovery
Original description
The description as published by the source.
A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-5504 wolfssl
- Ubuntu UBUNTU-CVE-2026-5504 wolfssl
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com