CVE-2026-3579 Non-constant time multiplication subroutine __muldi3 on RISC-V RV32I

Low 2.1 Published 19 Mar 2026 Updated 24 Mar 2026

Timing side-channel in wolfSSL on RISC-V RV32I may expose sensitive cryptographic data due to non-constant time multiplication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-3579?

CVE-2026-3579 is a low-severity vulnerability in Wolfssl Wolfssl, published on 19 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

wolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time software implementation for 64-bit multiplication. The compiler-inserted __muldi3 subroutine executes in variable time based on operand values. This affects multiple SP math functions (sp_256_mul_9, sp_256_sqr_9, etc.), leading to a timing side-channel that may expose sensitive cryptographic data.

Weakness: CWE-203

Which versions are affected by CVE-2026-3579?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2026-3579?

Apply the vendor's patch.

Is CVE-2026-3579 being exploited?

There is no known exploitation of CVE-2026-3579 in the wild and no public exploit code.

All Wolfssl Wolfssl vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-3579, GHSA-f5x4-gf23-wqm9, JLSEC-2026-709, UBUNTU-CVE-2026-3579.