CVE-2026-5479: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-5479 is an authentication tag bypass vulnerability in wolfSSL's EVP layer affecting ChaCha20-Poly1305 AEAD decryption. In the wolfSSL_EVP_CipherFinal function (and related EVP cipher finalization functions), the implementation computes or accepts the Poly1305 authentication tag but never compares it against the expected value before returning plaintext to the caller, allowing forged ciphertext to be accepted silently. All wolfSSL versions prior to 5.9.1 are affected. The vulnerability was published on April 10, 2026, and carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.6 (High) (GitHub Advisory, wolfSSL PR #10102).

The root cause is classified as CWE-354 (Improper Validation of Integrity Check Value). In the vulnerable code path, EVP_DecryptFinal_ex() called wc_ChaCha20Poly1305_Final(), which computed the Poly1305 tag and wrote it into ctx->authTag, overwriting the expected tag previously stored there by EVP_CTRL_AEAD_SET_TAG — but no comparison was ever performed between the computed and expected tags. The fix saves the expected tag before calling Final(), then verifies it using wc_ChaCha20Poly1305_CheckTag() on the decrypt path, mirroring the existing AES-GCM branch. Exploitation requires an adjacent network position and specific attack prerequisites (CVSS AT:P), meaning the attacker must be positioned to intercept or inject traffic using ChaCha20-Poly1305 encrypted with wolfSSL's EVP API. The vulnerability was discovered and reported by Nicholas Carlini (Anthropic) and Bronson Yen (Calif.io) (wolfSSL PR #10102).

Successful exploitation allows an attacker on an adjacent network to forge or modify ChaCha20-Poly1305 encrypted messages without detection, as the application will accept tampered ciphertext and return decrypted plaintext without validating message authenticity. This results in high confidentiality impact (decrypted plaintext of forged messages is exposed) and high integrity impact (unauthorized message modification goes undetected), with no availability impact. Any application using wolfSSL's EVP API for ChaCha20-Poly1305 decryption is affected, potentially enabling data exfiltration or injection of malicious content into encrypted communication channels (GitHub Advisory, wolfSSL PR #10102).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.007% (0th percentile), indicating a very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an adjacent network position and specific attack prerequisites, limiting the attacker pool compared to remotely exploitable vulnerabilities (GitHub Advisory).

1. Reconnaissance: Identify applications on the adjacent network that use wolfSSL versions prior to 5.9.1 for ChaCha20-Poly1305 encrypted communications via the EVP API (e.g., embedded devices, IoT firmware, or custom TLS implementations using wolfSSL).
2. Network positioning: Gain a man-in-the-middle position on the network segment between the communicating parties (e.g., via ARP spoofing, rogue access point, or compromised network device).
3. Intercept encrypted traffic: Capture ChaCha20-Poly1305 encrypted messages in transit between a wolfSSL-based application and its peer.
4. Forge or tamper with ciphertext: Modify the ciphertext payload and/or replace the Poly1305 authentication tag with an arbitrary or all-zero value. Because the vulnerable wolfSSL EVP layer never validates the tag, any tag value will be accepted.
5. Deliver forged message: Forward the tampered ciphertext to the target application. The application's call to EVP_DecryptFinal_ex() will succeed and return the decrypted (attacker-controlled) plaintext without raising an authentication error, achieving unauthorized message injection or data manipulation (wolfSSL PR #10102, GitHub Advisory).

• Network: Unexpected or anomalous traffic patterns on network segments where wolfSSL-based applications communicate; presence of ARP spoofing or other MitM indicators (duplicate ARP replies, unexpected MAC-to-IP mappings) on the local network segment.
• Logs: Application-level logs showing successful decryption of messages that were not sent by the legitimate peer; absence of authentication failure errors in wolfSSL-based applications that should be rejecting tampered messages.
• Process/Application Behavior: Applications accepting and processing unexpected or malformed plaintext content that should have been rejected by AEAD authentication; unusual application behavior following decryption operations using ChaCha20-Poly1305 via the EVP API.

Upgrade wolfSSL to version 5.9.1 or later, which includes the fix that saves the expected Poly1305 tag before finalization and verifies it using wc_ChaCha20Poly1305_CheckTag(). Identify and inventory all applications using wolfSSL's EVP API for ChaCha20-Poly1305 decryption and prioritize patching those systems. As a temporary measure until patching is complete, restrict network access to vulnerable systems to reduce the risk of adjacent-network exploitation. After patching, validate that all communications requiring message authentication integrity are functioning correctly with the updated library (wolfSSL PR #10102, GitHub Advisory).

The vulnerability was discovered by Nicholas Carlini (Anthropic) and Bronson Yen (Calif.io) as part of a coordinated vulnerability disclosure effort that also uncovered several other wolfSSL issues in the same pull request (including CMAC forgery, ECCSI signature bypass, and AES-GCM tag truncation). VulnCheck published a blog post covering CVEs credited to Anthropic researchers, highlighting the breadth of the findings. The NixOS community tracked the issue and related wolfSSL vulnerabilities in their package repository. No major vendor statements or widespread social media discussion beyond these technical communities have been observed (VulnCheck Blog, wolfSSL PR #10102).