CVE-2026-3230
Low
Description
Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS-protected communications via a crafted HelloRetryRequest followed by a ServerHello message that omits the required key_share extension, resulting in derivation of predictable traffic secrets from (EC)DHE shared secret. This issue does not affect the client's authentication of the server during TLS handshakes.
SeverityLow
CVSS2.7
Exploit probability—
ProductWolfssl
PublishedMar 19, 2026
First seenMar 19, 2026
Weakness typeCWE-20Improper input validation
How to fix
Update
- wolfssl wolfssl5.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wolfssl wolfssl | v < 5.9.0 | 5.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.