cve 2025 12889

CVE-2025-12889 is a TLS 1.2 vulnerability that allows a client to deliberately choose a weaker message digest than the server requested during client-certificate authentication, violating TLS 1.2 handshake rules. This flaw has been fixed in wolfSSL version 5.8.4. The issue specifically affects the hash and signature algorithm negotiation in TLS 1.2, potentially enabling downgrade attacks. Users of wolfSSL should update to the patched version to mitigate the risk. The tag covers discussions about the technical details of the vulnerability, its impact on TLS security, and the official fix released by wolfSSL.