CVE-2026-6330: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-6330 is a cryptographic implementation flaw in wolfSSL's ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism) ARM64 NEON code path, where the ciphertext comparison function only evaluates half of the input during decapsulation. This breaks the Fujisaki-Okamoto (FO) transform's implicit rejection mechanism, weakening IND-CCA2 (Indistinguishability under Chosen Ciphertext Attack) security guarantees. The vulnerability affects wolfSSL versions 5.7.4 through 5.9.1 and was disclosed on June 25, 2026. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.3 (Medium) (GitHub Advisory, wolfSSL PR).

The root cause is classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm), specifically a defect in the mlkem_cmp_neon function within wolfcrypt/src/port/arm/armv8-mlkem-asm.S and its C mirror in armv8-mlkem-asm_c.c. The NEON reduction step failed to fold the upper 64 bits of the comparison result into the lower 64 bits before the scalar check, causing the constant-time comparison to silently ignore the second half of the re-encrypted ciphertext. As a result, a decapsulating party running on ARM64 hardware with NEON enabled could accept a manipulated ciphertext that should have triggered implicit rejection under FIPS 203 (ML-KEM standard) requirements. The fix, merged in PR #10192, adjusts the NEON reduction logic and adds a regression test (test_mlkem.c) that tampers with the ciphertext and verifies FO rejection is correctly triggered (wolfSSL PR).

Successful exploitation allows an unauthenticated network attacker to submit a manipulated ciphertext that bypasses decapsulation validation, causing the decapsulating party to derive and use an incorrect shared secret without triggering the required implicit rejection. This undermines the confidentiality and integrity of key exchange sessions protected by ML-KEM on ARM64 NEON code paths, potentially enabling key recovery or session hijacking attacks against post-quantum cryptographic communications. Availability is not impacted, but the weakened IND-CCA2 guarantee could expose encrypted data to an active adversary capable of crafting and submitting chosen ciphertexts (GitHub Advisory, wolfSSL PR).

1. Identify target: Locate a service or application using wolfSSL versions 5.7.4–5.9.1 compiled for ARM64 with NEON and ML-KEM (--enable-armasm --enable-mlkem) enabled.
2. Initiate key exchange: Engage the target in a post-quantum key encapsulation exchange using ML-KEM, obtaining a legitimate ciphertext from the encapsulation step.
3. Craft manipulated ciphertext: Modify the second half of the ciphertext bytes (the portion ignored by the flawed NEON comparison), while keeping the first half intact to pass the partial comparison check.
4. Submit manipulated ciphertext: Send the crafted ciphertext to the decapsulating party. Due to the incomplete comparison, the FO implicit rejection is not triggered, and the decapsulator proceeds with an incorrect shared secret.
5. Exploit derived key material: Use knowledge of the manipulation to infer or recover the shared secret, enabling decryption of session traffic or further cryptanalytic attacks against the key exchange (wolfSSL PR, GitHub Advisory).

wolfSSL has released version 5.9.2 which contains the fix for this vulnerability; users should upgrade immediately from any affected version (5.7.4–5.9.1) (wolfSSL Security, wolfSSL PR). The patch corrects the NEON reduction logic in mlkem_cmp_neon to properly fold upper 64-bit comparison results before the scalar check, restoring full ciphertext comparison. As a short-term workaround for systems that cannot immediately upgrade, disabling the ARM64 NEON ML-KEM code path (by not using --enable-armasm --enable-mlkem together on AArch64 builds) would avoid the vulnerable code path. Administrators should also audit any systems that used wolfSSL's ML-KEM on ARM64 for potential past exposure, as the weakened IND-CCA2 security may have been exploitable during the affected version window.

Cryptographer Daniel J. Bernstein (djb) commented on the vulnerability via Mastodon (mastodon.cr.yp.to) and published a blog post on July 4, 2026 at blog.cr.yp.to/20260704-bugs.html discussing the bug in the context of post-quantum cryptography implementation quality. The CVE was noted to have been credited to Anthropic (AI-assisted discovery), with a related GitHub repository (patrickmgarrity/Anthropic-Credited-CVEs) tracking the finding. The vulnerability received coverage on standard CVE tracking platforms and was picked up by Debian packaging maintainers, who submitted wolfSSL 5.9.2-1 to the Debian NEW queue shortly after disclosure.