CVE-2026-6331: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-6331 is an HMAC zero-length tag forgery vulnerability in wolfSSL's EVP_DigestVerifyFinal function, classified as an improper verification of cryptographic signature (CWE-347). In the OpenSSL-compatibility HMAC verification path, the supplied signature length was only checked to not exceed the MAC length — meaning a zero-length or truncated tag could pass verification without being rejected. The vulnerability affects wolfSSL versions 3.15.5 through 5.9.1 and was disclosed on June 25, 2026, with a patch released in version 5.9.2. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 2.1 (Low), reflecting differing assessments of exploitability context (GitHub Advisory, wolfSSL PR).

The root cause lies in insufficient length validation within wolfSSL's OpenSSL-compatibility EVP_DigestVerifyFinal HMAC verification path (CWE-347). The code only checked that the supplied signature length did not exceed the MAC length, rather than requiring an exact match — allowing a zero-length or otherwise truncated tag to satisfy the check and be accepted as valid. The fix, introduced in PR #10192, enforces that the supplied tag length must exactly equal the MAC length and explicitly rejects zero-length MACs. The vulnerability was internally tracked as ZD#21457 (item 31) and was discovered and reported by contributor mattia-moffa (wolfSSL PR, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to forge HMAC signatures by supplying a zero-length or truncated tag that is incorrectly accepted as valid, effectively bypassing authentication or integrity checks that rely on HMAC verification in applications using wolfSSL's OpenSSL-compatibility API. The impact is limited to integrity — there is no confidentiality or availability impact — but the ability to bypass cryptographic authentication checks could enable unauthorized access, message tampering, or impersonation in protocols and applications that depend on HMAC for authentication (GitHub Advisory, wolfSSL PR).

1. Identify target: Locate an application using wolfSSL versions 3.15.5–5.9.1 that performs HMAC verification via the OpenSSL-compatibility API (EVP_DigestVerifyFinal).
2. Craft forged message: Prepare a message with an arbitrary payload that would normally fail HMAC verification.
3. Supply zero-length or truncated tag: When calling or interacting with the HMAC verification endpoint, supply a zero-length (empty) byte string as the HMAC tag/signature.
4. Bypass verification: The vulnerable length check (siglen <= macLen) passes for a zero-length input, causing EVP_DigestVerifyFinal to return success without validating the actual MAC value.
5. Achieve authentication bypass: The forged message is accepted as authenticated, allowing the attacker to bypass integrity or authentication controls in the target application (wolfSSL PR, GitHub Advisory).

Users should upgrade wolfSSL to version 5.9.2 or later, which enforces exact tag length equality in EVP_DigestVerifyFinal and rejects zero-length MACs. The fix was merged into the wolfSSL master branch on April 15, 2026, via PR #10192 and formally released with version 5.9.2. No configuration-based workaround is available; upgrading is the only remediation. Developers using the OpenSSL-compatibility HMAC API should audit their applications to confirm they are running the patched version (wolfSSL PR, wolfSSL Security).

The vulnerability was noted in automated CVE tracking feeds and social media aggregators shortly after disclosure, including posts on Bluesky and CVE feed services. The wolfSSL project assigned the CVE itself and published the fix proactively. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database entries (GitHub Advisory).