What’s Vulnerable › Vulnerabilities
CVE-2026-5504: PKCS7 CBC Padding Oracle — Plaintext Recovery
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-09 · updated 2026-06-17
- Weakness: CWE-354
Description
A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated.
Affected products
- wolfSSL: through 5.9.0
References
Get alerted when CVE-2026-5504 or the next vulnerability affects your stack