CVE-2026-6291 Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption
An attacker can exploit a padding oracle in wolfSSL's PKCS#7 decryption to recover the Content Encryption Key, exposing encrypted data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6291?
CVE-2026-6291 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 25 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA PKCS#1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding validation failed versus whether the decrypted content was malformed. An attacker able to submit crafted EnvelopedData messages and observe error responses could use this as a padding oracle to incrementally recover the encrypted Content Encryption Key (CEK). The fix generates a deterministic pseudo-random fake CEK on padding failure (via HMAC-SHA256) and proceeds with decryption identically, using constant-time operations throughout, so that all failure paths produce the same error regardless of padding validity.
Weakness: CWE-208
Which versions are affected by CVE-2026-6291?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2026-6291?
Apply the vendor's patch.
Is CVE-2026-6291 being exploited?
There is no known exploitation of CVE-2026-6291 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2026-6291, GHSA-hvwm-w7rw-23cv, JLSEC-2026-745, UBUNTU-CVE-2026-6291.