CVE-2026-16516 wolfSSH ECDSA host key curve not validated against negotiated algorithm
An active man-in-the-middle attacker can bypass SSH host key verification by substituting ECDSA curves, potentially leading to session hijacking if lax key checks are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16516?
CVE-2026-16516 is a critical vulnerability in wolfSSL Inc. wolfSSH, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key).
Weakness: CWE-345
Which versions are affected by CVE-2026-16516?
It affects 1 product.
Products include Wolfssh Wolfssh.
How do I fix CVE-2026-16516?
No fix has been published for CVE-2026-16516 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16516 being exploited?
There is no known exploitation of CVE-2026-16516 in the wild and no public exploit code.
Other vulnerabilities in wolfSSL Inc. wolfSSH
Sources
Also known as GHSA-c487-h25j-24jq.