CVE-2026-6329 PKCS#12 MAC verification uses attacker-controlled comparison length
Attackers can bypass PKCS#12 MAC integrity checks by supplying truncated MACs, allowing tampered files to be accepted as valid.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6329?
CVE-2026-6329 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 25 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted. The PKCS#12 verify path compared the locally computed HMAC against the MAC parsed from the PKCS#12 structure using a length taken directly from the attacker-supplied input, without first verifying that it equals the length of the digest actually produced by the configured algorithm. A truncated or zero-length stored MAC could therefore be accepted, defeating the integrity protection of the MAC.
Weakness: CWE-347
Which versions are affected by CVE-2026-6329?
It affects 1 product.
Products include Wolfssl Wolfssl.
How do I fix CVE-2026-6329?
Apply the vendor's patch.
Is CVE-2026-6329 being exploited?
There is no known exploitation of CVE-2026-6329 in the wild and no public exploit code.
Other vulnerabilities in Wolfssl Wolfssl
Sources
Also known as DEBIAN-CVE-2026-6329, GHSA-r98j-g9p3-fcgm, JLSEC-2026-747, UBUNTU-CVE-2026-6329.