CVE-2025-11933 DoS Vulnerability in wolfSSL TLS 1.3 CKS Extension
Remote attackers can cause denial of service in wolfSSL by sending crafted ClientHello messages with duplicate CKS extensions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-11933?
CVE-2025-11933 is a low-severity denial of service vulnerability in Wolfssl Wolfssl, published on 21 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a denial-of-service via a crafted ClientHello message with duplicate CKS extensions.
Weakness: CWE-20
Which versions are affected by CVE-2025-11933?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2025-11933?
No fix has been published for CVE-2025-11933 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-11933 being exploited?
There is no known exploitation of CVE-2025-11933 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2025-11933, GHSA-g9wx-2hxf-f2rj, UBUNTU-CVE-2025-11933.