cve 2025 11933

About this tag
CVE-2025-11933 is a denial-of-service vulnerability in wolfSSL versions 5.8.2 and earlier, caused by improper handling of duplicate key_share entries in TLS 1.3 ClientHello messages. An unauthenticated remote attacker can exploit this flaw to trigger excessive resource consumption, leading to application-level DoS. The issue was fixed in wolfSSL 5.8.4. This tag covers discussions about the vulnerability, its impact on TLS 1.3 implementations, and the patch released by wolfSSL.

  1. wolfSSL Patch Fixes TLS 1.3 Duplicate KeyShare DoS CVE-2025-11933

    wolfSSL has published a patch and coordinated disclosures after researchers reported a denial‑of‑service weakness in its TLS 1.3 ClientHello parsing: specially crafted ClientHello messages that include duplicate key_share (CKS) entries can force excessive resource consumption in wolfSSL 5.8.2...