CVE-2021-32755: Certificate pinning is not enforced on the web socket connection

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-13 · updated 2026-06-17
Weakness: CWE-295

Description

Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In the 3.82 version of the iOS application, a new web socket implementation was introduced for users running iOS 13 or higher. This new websocket implementation is not configured to enforce certificate pinning when available. Certificate pinning for the new websocket is enforced in version 3.84 or above.

Affected products

wireapp wire-ios: before 3.84 — fixed in 3.84

How to fix

Upgrade to a fixed version: wireapp wire-ios 3.84. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-32755 or the next vulnerability affects your stack