CVE-2026-5504 — PKCS7 CBC Padding Oracle — Plaintext Recovery

CVE-2026-5504

PKCS7 CBC Padding Oracle — Plaintext Recovery PUBLISHED

Description (CNA)

A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated.

Affected (CNA)

Vendor / product	Versions
wolfSSL / wolfSSL	affected 0 through 5.9.0

CWE

CWE-354

References

https://github.com/wolfSSL/wolfssl/pull/10088

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.