CVE-2025-11934 Improper Validation of Signature Algorithm Used in TLS 1.3 CertificateVerify

What is CVE-2025-11934?

CVE-2025-11934 is a low-severity vulnerability in Wolfssl Wolfssl, published on 21 Nov 2025.

Official description

Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for downgrading the signature algorithm used. For example when a client sends ECDSA P521 as the supported signature algorithm the server previously could respond as ECDSA P256 being the accepted signature algorithm and the connection would continue with using ECDSA P256, if the client supports ECDSA P256.

Weakness: CWE-20

Which versions are affected by CVE-2025-11934?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2025-11934?

No fix has been published for CVE-2025-11934 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-11934 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11934 exists.

Other vulnerabilities in Wolfssl Wolfssl

• CVE-2024-5991 Buffer overread in domain name matching Critical 10.0
• CVE-2021-37155 Security feature bypass in n/a Critical 9.8
• CVE-2020-36177 Memory corruption in n/a Critical 9.8
• CVE-2014-2896 Memory corruption in n/a Critical 9.8
• CVE-2014-2897 Memory corruption in n/a Critical 9.8

All Wolfssl Wolfssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-11934, GHSA-wq2x-6c88-jrh3, UBUNTU-CVE-2025-11934.