CVE-2026-8720: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-8720 is a cryptographic bypass vulnerability in wolfSSL's HMAC-BLAKE2 implementation where wc_Blake2bHmacFinal and wc_Blake2sHmacFinal produce a message authentication code (MAC) that is independent of the input message when the supplied key exceeds the BLAKE2 block size. The bug was introduced with the HMAC-BLAKE2 APIs added in wolfSSL version 5.9.0 and affects versions 5.9.0 through 5.9.1. It was disclosed on June 25, 2026, with a patch merged on May 12, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.9 (Medium) (GitHub Advisory, wolfSSL PR).

The root cause is classified as CWE-354 (Improper Validation of Integrity Check Value). When a key longer than the BLAKE2 block size (64 bytes for BLAKE2b, 32 bytes for BLAKE2s) is supplied, the key-hashing branch incorrectly reinitialized the running hash state using the same state object being used for the HMAC inner hash computation, thereby discarding all accumulated message data. The fix, contributed by mattia-moffa in PR #10447, resolves this by hashing oversized keys using a dedicated temporary Blake2* state (keyHash) rather than reusing the caller's active hash state, and by zero-initializing the block-sized key buffer (x_key) to ensure correct zero-padding per the HMAC specification (wolfSSL PR, GitHub Advisory).

Successful exploitation allows an attacker or a malicious caller to forge valid MACs for arbitrary messages when using the HMAC-BLAKE2 APIs with keys longer than the block size, since the resulting MAC depends only on the key and not on the message content. This represents a high integrity impact — any system relying on HMAC-BLAKE2 for message authentication, data integrity verification, or authentication tokens could be undermined, allowing tampered data to pass MAC validation. Confidentiality and availability are not directly affected (GitHub Advisory, wolfSSL PR).

1. Identify vulnerable deployment: Confirm the target application uses wolfSSL versions 5.9.0 or 5.9.1 and calls wc_Blake2bHmacFinal or wc_Blake2sHmacFinal with a key longer than 64 bytes (BLAKE2b) or 32 bytes (BLAKE2s).
2. Craft an oversized key: Supply a key exceeding the BLAKE2 block size to the HMAC-BLAKE2 API. Due to the bug, the MAC output will be determined solely by the key, not the message.
3. Compute the predictable MAC: Since the MAC is message-independent, compute the MAC for any known message using the same oversized key to obtain the fixed MAC value.
4. Forge authenticated messages: Use the computed MAC to authenticate arbitrary, attacker-controlled messages, bypassing integrity checks in the target application that relies on HMAC-BLAKE2 for message authentication (wolfSSL PR, GitHub Advisory).

wolfSSL has released version 5.9.2 which contains the fix for this vulnerability; users should upgrade immediately (wolfSSL Security, wolfSSL PR). As a temporary workaround if patching is not immediately possible, ensure that HMAC-BLAKE2 key material does not exceed the BLAKE2 block size (64 bytes for BLAKE2b, 32 bytes for BLAKE2s), or discontinue use of the wc_Blake2bHmacFinal and wc_Blake2sHmacFinal APIs until the patch is applied. FreeBSD ports and Debian packages have also begun tracking the updated version (FreshPorts).

The vulnerability was noted in automated CVE tracking feeds and vulnerability databases shortly after disclosure, including VulDB, CIRCL, and ENISA's EUVD. Tenable published a Nessus plugin (ID 323814) to detect affected wolfSSL versions. No significant public researcher commentary or media coverage beyond standard vulnerability tracking has been observed.