CVE-2025-11936

MediumCVSS 5.3/10Last modified Oct 19, 2026

Description

Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a denial-of-service by sending a crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group, leading to excessive CPU and memory consumption during ClientHello processing.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
wolfSSL	wolfSSL	>= 3.12.0, < 5.8.4

References

https://github.com/wolfSSL/wolfsslProduct
https://github.com/wolfSSL/wolfssl/pull/9117Issue Tracking, Patch
https://github.com/wolfSSL/wolfssl/pull/9117Issue Tracking, Patch

Timeline

Published: Nov 21, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-119376.9Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediaw CVE-2025-119388.1A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing CVE-2025-119397.2A vulnerability was determined in ChurchCRM up to 5.18.0. This issue affects some unknown processing of the file src/ChurchCRM/Backup/Restor CVE-2025-11946.5A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the fil CVE-2025-119407.0A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setu CVE-2025-119418.1A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=av CVE-2025-119429.8A flaw has been found in 70mai X200 up to 20251010. Affected is an unknown function of the component Pairing. Executing manipulation can lea CVE-2025-119439.8A vulnerability has been found in 70mai X200 up to 20251010. Affected by this vulnerability is an unknown functionality of the component HTT CVE-2025-119447.2A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php CVE-2025-119453.5A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload I CVE-2025-119465.4A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /fro CVE-2025-119474.5A weakness has been identified in bftpd up to 6.2. Impacted is the function expand_groups of the file options.c of the component Configurati