Summary
generated automatically from NVD datawolfSSH through 1.5.0, when built with --enable-fwd, fails to apply its forwarding policy callback to forwarded-tcpip channel opens in DoChannelOpen() (src/internal.c), which only checks direct-tcpip opens. A malicious SSH peer can therefore open unauthorized forwarding channels without any cap, causing unbounded per-channel buffer allocation, and a malicious server can open channels to addresses and ports the client never registered with tcpip-forward. The flaw is a missing authorization issue (CWE-862) rated CRITICAL with a CVSS v3.1 score of 9.1.
NVD description
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.
EPSS · FIRST.org
0.27%probability of exploitation in the next 30 days
Higher than 17% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 7 oct. 2026
- Updated
- 13 oct. 2026
- Status
- Analyzed
- Source
- facts@wolfssl.com
Affected products
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-862
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.