CVE-2026-6291

MediumCVSS 6.5/10Last modified Jun 26, 2026

Description

Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA PKCS#1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to submit crafted EnvelopedData messages and observe error responses could use this as a padding oracle to incrementally recover the encrypted Content Encryption Key (CEK). The fix generates a deterministic pseudo-random fake CEK on padding failure (via HMAC-SHA256) and proceeds with decryption identically, using constant-time operations throughout, so that all failure paths produce the same error regardless of padding validity.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-208

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2026
Last modified
Jun 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-629108.8Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privilCVE-2026-629118.0Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-629126.5Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.CVE-2026-629138.8Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.CVE-2026-629145.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacCVE-2026-629156.5Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.CVE-2026-629169.8Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a CVE-2026-629174.6Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.CVE-2026-629187.5Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.CVE-2026-62924.3The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0.CVE-2026-629256.5Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependencyCVE-2026-629277.5In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculati