ESP32_Serial_Swiss_Army_Knife/docs/wolf_security_review.md

Phase 9D — wolfSSL / wolfSSH advisory review (partial)

Implementation addendum — 2026-09-16

Xtensa small-math mitigation implemented; the broader review and security sign-off remain open. Root CMakeLists.txt defines CURVE25519_SMALL and ED25519_SMALL before component parsing. cmake/wolf_crypto_policy.cmake propagates a forced-include resolved-settings guard PUBLIC from wolfSSL to consumers, including wolfSSH/application code. cmake/wolf_crypto_policy.h requires both enabled small implementations, rejects WOLFSSL_CURVE25519_BLINDING, and rejects enabling Curve448/Ed448 without review. This follows PR 9275's small-math policy for the enabled Xtensa algorithms, with consistent library/consumer production flags and ABI-sensitive layouts. Blinding is not enabled with small X25519: wolfSSL 5.8.2 excludes/rejects this combination; do not force it back on or present the historical blinding observation below as current policy.

Parser corrections implemented: tools/security_overrides.py extends the existing hash-pinned wolfSSH generated source (now eight C source overrides plus one header overall). The PR892 subset bounds DoIgnore/GetSkip and service-string reads, accepts boundary-empty skips, rejects zero-capacity GetString, and preserves the old strict service-name length limit. The PR881 subset rejects channel-window addition overflow without changing the window. The PR880 subset changes both ECC/Ed25519 key/signature label comparisons to short-circuit OR. Local framing corrections bound ECC r/s reads to the declared sub-blob and require exact inner/outer consumption; Ed25519 also requires exact outer consumption. Valid framing and crypto/digest/message construction remain unchanged; formerly tolerated malformed labels/trailing bytes reject. Existing password bounds/wiping and async-pending retention remain intact. See the parser contract and deferred scope; these are subsets, not complete PR backports. PR899 has no applied hunks; service semantics, other parsers and standalone ECC key-blob semantics remain open.

Crypto validation implemented: PUBLIC WOLFSSL_VALIDATE_ECC_IMPORT and WOLFSSL_ECDHX_SHARED_NOT_ZERO enable existing upstream P-256 import validation and X25519 all-zero-result rejection. The guard rejects missing checks and reviewed validator-disabling/hardware-stub configurations. Strict production checks confirm the effective flags without candidate injection. The key-validation review traces the previously missing unauthenticated P-256 KEX point check and low-order X25519 inputs that pass the old precheck. Current raw SSH signature callers supply locally derived full digests; no current short-digest/OID-confusion trigger was found. This does not backport generic PR10131 API hardening or demonstrate an exploit. Import validation adds CPU/allocation cost requiring target measurement.

Supplied parent build evidence: pio run PASS, 94,340 B linked RAM / 1,768,701 B flash, unchanged RAM / −248 B flash versus 1,768,949 B. Final parent results: all six suites PASS — ordering --interop (8,028 checks, seven rejected mutations, 12 exact-256-KiB sessions with clean channel close/transport EOF), SDK overrides with actual --build-dir registration, auth (135 cases), protocol, strict crypto and parser (3,124 cases × two modes). Interop's unsandboxed approval was solely for local AF_UNIX sockets; no remote network or device operation. See dated evidence and limits. These are supplied results, not build/test reruns by this documentation update or runtime-headroom evidence.

Restricted ordering correction implemented for CVE-2025-14942; not a full upstream backport or advisory/phase sign-off. Deferred parser/API/advisory review, whole-phase target validation and license/source packaging remain open. No dependency upgrade or device operation was performed. Phase 9 is not complete or production-ready.

Restricted ordering correction and remaining gates

The earlier temporary attempt is superseded by the implemented restricted-profile correction and prerequisite disposition. wolfSSH remains pinned to 1.4.20 with the existing Curve25519-SHA256 / ECDH-P256 KEX profile; DH/GEX/PQ widening is rejected. Independent SELF/PEER keying bits, exact nonzero expected-message tracking and service/authentication phase gates reject wrong-direction, premature and duplicate traffic. Receive expectations are separate from send-side rekey fences. Pre-peer-KEXINIT in-flight traffic remains legal when only SELF initiated rekey.

SendNewKeys queues one packet under the old sending keys and installs new sending keys; SUCCESS or WANT_WRITE clears SELF, retaining PEER and its expected NEWKEYS. Existing flush paths finish the same buffered packet without resending NEWKEYS. EXT_INFO is intentionally disabled, rather than adding a pending extension continuation: no ext-info-c, no outgoing EXT_INFO, incoming EXT_INFO rejected, sendExtInfo/extInfoSent remain zero. There is no server-sig-algs advertisement now; the KeyAccepted setter does not produce that wire extension. RSA-SHA2 discovery/RSA user-key interoperability is not claimed.

The executable consolidated edits are delta.json, not all hunks of PR793/819/840/855/921. provenance.json records exact archived patch byte hashes, source URLs and full embedded commit IDs; preserve those archives rather than relying on mutable PR responses. Original source/header hashes are pinned, upstream notices retained, and generated wolfSSH files carry the 2026-09-16 ordering modification/provenance notice. There are eight C overrides plus one generated wolfssh/internal.h. CMake propagates the ABI overlay BEFORE PUBLIC and as a PUBLIC forced include, with a stale-header guard and configure/compiler dependencies. Joined -include/path arguments preserve both ordering and crypto forced headers through PlatformIO sorting/deduplication; the adapter regression exercises a real Xtensa consumer and a failing split-option mutation.

Review found a misplaced EOF guard; it is now corrected in SendChannelEof before lookup/serialization/eofTxd mutation. The extra SendChannelExit guard remains intentional local hardening, not PR793's EOF hunk. Follow-up verification found no scoped blocker. Supplied ordering evidence: 8,028 checks and seven rejected mutations, including actual EOF/shutdown/exit-status rekey fences.

The initial host interoperability run failed a close race despite printing INTEROP PASS early; that output was not successful completion. The corrected harness waits for peer channel close and transport EOF, uses a local fd-passing proxy, independently owns/reaps the server, and requires both process exits to be zero. Final agent evidence: 36/36 repeated OpenSSH 10.2p1 sessions, each exact 256 KiB binary echo, with ten completed exchanges for client-rekey cases or two for fragmented server-rekey cases, clean exits and no EXT_INFO. See the test contract, harness diagnosis and limits. This establishes bounded host interoperability, not general shutdown correctness or device behavior.

Official registry queries for wolfSSH 1.5.0 and wolfSSL 5.9.2 returned 404 on 2026-09-15. Upstream tags exist at wolfSSH commit 8643d7be841184f766374e3b0ed68ced6391543c and wolfSSL commit ac01707f552c611fbd135cc723b2682b3e7f80f2; tag existence is not managed-component availability or ESP compatibility. This is supplied query evidence, not a fresh network check by this documentation update.

Remaining gates: target cleanup/disconnect during rekey, no-EXT_INFO compatibility with intended clients, initial KEX/rekey under load, and stack/heap/timing measurements during whole-phase validation. The broader advisory/parser review and release packaging remain open. Any future upstream upgrade still needs isolated packaging/compatibility evaluation, coherent source/header review and explicit rebasing of source overrides and version/callback contracts while preserving password/parser/crypto protections. The restricted correction is not a full wolfSSH 1.4.22/1.5.0 backport, dependency upgrade, or phase sign-off.

Historical pre-mitigation research baseline — 2026-09-15

The remainder retains the original pre-mitigation research evidence. “Current” macros, generated hashes, priorities and “not applied/tested” statements below describe that historical snapshot, not today's implementation. The addendum and linked key-validation review supersede the scoped small-math, parser, ECC/X25519 and ordering status claims. Restricted ordering is implemented; its target/compatibility gates and explicitly deferred findings remain open.

Review date: 2026-09-15. Read-only external research and local applicability inspection; stopped at the user's requested handoff. Not a completed security review or release clearance. Only this new report was written. No dependencies, sources, generated inputs, or parent documents were changed; no build, hardware test, network exploit, or public PoC was executed.

Release decision / current-path priorities

1. Block security sign-off pending mitigation of CVE-2025-12888. Current SSH advertises X25519 on Xtensa, and actual compiler preprocessing confirms the affected non-small implementation. Upstream recommends the small implementation; existing blinding is not evidence that this separate compiler/architecture issue is resolved. Exploitability on this precise GCC/optimization/device combination was not measured.
2. Block sign-off pending a reviewed wolfSSH message-order correction. CVE-2025-14942 is critical for clients; upstream explicitly recommends its fix for servers because the same defect exists, without identifying a specific server attack. The generated local server state machine lacks the fix. Do not report demonstrated server password disclosure or authentication bypass from this evidence.
3. Close current-path parser gaps before sign-off. Upstream wolfSSH PR 892 fixes unchecked SSH_IGNORE/service-string parsing still present in the generated source. These are security-relevant malformed-input handling defects, not assigned CVEs in the inspected release notes. Actual out-of-allocation access/exploit impact remains unproven: packet padding and enclosing receive-buffer invariants need auditing. Phase 9C's password fix does not fix these handlers.
4. Keep ECC validation and other non-CVE hardening open. Current ECC import lacks WOLFSSL_VALIDATE_ECC_IMPORT; 5.9.1 release notes explicitly recommend this flag for older versions. Whether the SSH ECDH path already performs equivalent validation before scalar multiplication was not resolved. Do not call this a confirmed invalid-curve vulnerability.

Smallest proposed mitigation for item 1: enable CURVE25519_SMALL consistently for library and consumers through project-owned compile policy; upstream PR 9275 also enables ED25519_SMALL, CURVE448_SMALL, and ED448_SMALL on Xtensa. For enabled algorithms, follow that upstream policy rather than assume X25519 blinding suffices. Check the effective blinding/small combination, ABI, compile guards, performance, and real SSH interoperability. This was not applied or tested.

Item 2 is not a safe one-line patch. PR 855 changes internal.c, handshake layout in wolfssh/internal.h, message ranges, expected-message tracking, and logging; 1.4.20 also predates intervening rekey changes. A backport needs the coherent library/header change set, audit of prerequisites, and later PR 921 follow-up noted in 1.5.0. Prefer evaluating wolfSSH 1.5.0 + wolfSSL 5.9.2, the newest stable releases returned by the queried APIs, rather than merely reaching the minimum fixed release. This is a candidate pair, not verified ESP managed-component availability or compatibility. Any upgrade requires rebasing exact-hash Phase 9C overrides, auth/version guards, callback changes (including keyboard auth), and contract tests; do not blindly repin.

For item 3 the smallest candidate backport is the bounded GetSkip/GetString handling from PR 892, including necessary helper semantics, plus regression cases for truncated/oversized/wrapping lengths. Preserve Phase 9C password framing and wiping. No backport has been proven safe by this report.

Local evidence and effective policy

• dependencies.lock: wolfssl/wolfssl 5.8.2~1 (upstream 5.8.2), component hash 4d619e882c19d967bbaa53302e3bd2bdb8c611b5efb13302171aace809fccfdf; wolfssl/wolfssh 1.4.20, component hash 24d623360c07374a90b1ade8d1218b24bb7b661fd51ace9135dccf510a338927.
• Actual database: .pio/build/esp32-s3-devkitc-1-n16r8/compile_commands.json. Replayed four actual compiler commands with -E -dM, removing compilation/output/dependency-write flags, capturing stdout only: wolfCrypt ecc.c, curve25519.c, random.c, and generated wolfSSH security_overrides/wolfssh_internal/internal.c. All four preprocessing invocations returned 0. This is current compile-policy evidence, not proof the flashed binary matches it.
• Compiler: xtensa-esp32s3-elf-gcc, __GNUC__=14, __GNUC_MINOR__=2, __XTENSA__=1; representative wolfCrypt commands use -Og.
• Generated wolfSSH input SHA-256: 1c04d26d46f7bef61eefcf0b78c43742662001bf6054ad2383500c9063c62494. tools/security_overrides.py pins original internal.c SHA-256 81ff1f9166708abd5c2911e9fe57c0aee01c88b5d3f68c909ee8a856d37f36a9; edits bound both password lengths with GetSize, prevent malformed new-password framing reaching the callback, and wipe the checked method suffix. No message-order or IGNORE/service parsing correction appears in those edits.
• src/ssh_protocol_policy.c: KEX curve25519-sha256,ecdh-sha2-nistp256; host key ecdsa-sha2-nistp256; ciphers AES-128/256-GCM; MAC advertisement HMAC-SHA256; user-key advertisement Ed25519/P256. Database authorization remains separate from advertisement.
• src/ssh_transport.c: creates WOLFSSH_ENDPOINT_SERVER; sets authentication callbacks, explicit keyboard rejection, shell acceptance, and exec/subsystem rejection. Project memory identifies wolfCrypt as SSH crypto, not the HTTPS provider. However, WOLFCRYPT_ONLY and NO_TLS are absent in the actual macros: “used only for crypto” must not be mislabeled “TLS compiled out.” No duplicate IDF/mbedTLS advisory assessment is made here.

Area	Effective observations	Consequence
Math	USE_FAST_MATH present; WOLFSSL_SP_MATH, WOLFSSL_SP_MATH_ALL, WOLFSSL_HAVE_SP_ECC, WOLFSSL_HAVE_SP_DH, WOLFSSL_SP_NONBLOCK absent	TFM, not SP. SP-specific release fixes are not automatically current-path findings.
DH	NO_DH present; generated SSH also has WOLFSSH_NO_DH	Finite-field DH and SSH DH-GEX fixes are not current negotiated features. ECDH is distinct and remains enabled.
ECC	HAVE_ECC, ECC_TIMING_RESISTANT, HAVE_ECC_CHECK_KEY present; WOLFSSL_VALIDATE_ECC_IMPORT, USE_ECC_B_PARAM absent; HAVE_ECC_CHECK_PUBKEY_ORDER appears in ecc.c after its internal includes	A compiled key-check implementation is not proof callers invoke it. ecc.c:10993–10996 gates import-time checking on the absent validation flag.
X25519 / Ed25519	HAVE_CURVE25519, HAVE_ED25519, WOLFSSL_CURVE25519_BLINDING present; CURVE25519_SMALL, ED25519_SMALL absent	CVE-2025-12888 configuration matches; earlier blinding hardening is enabled.
RNG	HAVE_HASHDRBG, WC_RNG_SEED_CB present; custom generate-block/seed macros absent; wc_SetSeed_Cb(ssh_seed) registration observed	Project callback supplies wolfCrypt Hash-DRBG seeding. Do not confuse this with OpenSSL RAND-after-fork or claim entropy quality was tested.
AES / hardware	HAVE_AESGCM present; streaming GCM absent; ESP32 crypto port present, hardware AES/hash explicitly disabled; RSA hardware-disable macro absent	Current AES/hash software policy is intentional. Not an all-software-crypto claim.
Optional APIs	HAVE_PKCS7, HAVE_ECCSI, HAVE_CHACHA, HAVE_XCHACHA, HAVE_POLY1305, OPENSSL_EXTRA absent; ASN template present/original absent	Many crypto-only advisories still need feature/API filtering, not just TLS exclusion.
SSH features	WOLFSSH_CERTS, WOLFSSH_SFTP, WOLFSSH_SCP, WOLFSSH_FWD, WOLFSSH_AGENT absent; NO_WOLFSSH_CLIENT absent	No certificate/file-transfer/forwarding feature; client code not compile-disabled, but inspected application is server-only.

Priority advisory evidence table

Dates below are CVE record publication dates (UTC), not reservation or release dates. Upstream severity does not by itself establish local exploitability. Source URLs are listed below.

ID / upstream severity	Published	Affected / fixed upstream	Local applicability and evidence
CVE-2025-12888 / Low	2025-11-21	<5.8.4; fixed 5.8.4, wolfSSL PR 9275	Applicable configuration, immediate mitigation priority. Xtensa + advertised X25519 + small implementation absent. Patch inspected.
CVE-2025-14942 / Critical (client)	2026-01-06	<1.4.22; fixed 1.4.22, wolfSSH PR 855	Potential server impact / upstream recommends server fix. Generated internal.c:587–623 has old accept-state filtering, no expected-message tracking. Critical client credential-leak scenario is not this application's role.
CVE-2025-11625 / Critical	2025-10-21	<=1.4.20 client; fixed 1.4.21, PR 840	Not current role. Host-verification bypass/credential leak concerns wolfSSH clients. CNA version string is malformed (1.4.20;0); range taken from official release notes.
CVE-2025-11624 / Medium	2025-10-21	1.3.0–1.4.20 inclusive; fixed 1.4.21, PR 834	Not current feature. SFTP file-handle stack overflow; SFTP absent.
CVE-2025-15382 / Medium	2026-01-06	Release notes: 1.4.12–1.4.21 inclusive; fixed 1.4.22, PR 859	Not current feature. SCP clean-path overread. CNA incorrectly/differently says <1.4.21; use conservative release-note range and retain discrepancy.
CVE-2026-0930 / Low	2026-04-20	1.4.15–<1.5.0; fixed 1.5.0	Not current platform/application. Windows wolfSSHd terminal resize. Release notes name PR 864; CNA references PR 846 instead. Discrepancy not resolved.
CVE-2026-5194 / Critical	2026-04-09	3.12.0–<5.9.1; fixed 5.9.1, wolfSSL PR 10131	Not demonstrated on current SSH flow. Certificate OID/type confusion absent without SSH certificates. Patch also hardens low-level ECC digest lengths, so crypto-only use is not a blanket exclusion. Inspected SSH paths derive digest sizes from hash IDs; finish tracing every current raw-signature call before closure.
CVE-2026-5187 / Low	2026-04-09	<=5.9.0; fixed 5.9.1, PR 10025	No current trigger established. DecodeObjectId/unknown ASN.1 extension handling; raw SSH keys are not X.509 extensions. ASN is compiled for keys/signatures, so retain API reachability check rather than claim all ASN parsing absent.
CVE-2025-13912 / Low	2025-12-11	<5.8.4; fixed 5.8.4, PR 9148	Not reported compiler/architecture combination. Advisory describes Clang on AArch64/RISC-V/x86_64; current GCC14.2 Xtensa. Separate from CVE-2025-12888.
CVE-2025-7396 / Low	2025-07-18	Blinding introduced 5.8.0, enabled by default in applicable 5.8.2 builds	Existing mitigation present: actual WOLFSSL_CURVE25519_BLINDING. CNA affected string 5.8.0; 0 is not a usable precise range. Not a resolution of the Xtensa advisory.

Post-pin release review, including changes without CVEs

Product / version	Release-note date / GitHub publication UTC date	Scope checked
wolfSSL 5.8.4	2025-11-20 / 2025-11-21	Xtensa small implementations, Clang hardening, TLS advisories, ESP SHA changes.
wolfSSL 5.9.0	2026-03-18 / 2026-03-19	TLS/PKCS/CRL advisories; RISC-V SP timing, KCAPI ECC import, RNG/port changes.
wolfSSL 5.9.1	2026-04-08 / 2026-04-08	Certificate/digest checks; ECC import validation; SP and hardware-port hardening.
wolfSSL 5.9.2	2026-06-23 / 2026-06-25	Latest stable returned; additional crypto validation, zeroization, SP/DH, PKCS, TLS and platform fixes. Unreleased master material is not a release candidate.
wolfSSH 1.4.21	2025-10-20 / 2025-10-22	Client/SFTP CVEs; rekey PR 793, auth rejection fixes, keyboard callback changes.
wolfSSH 1.4.22	2026-01-05 / 2026-01-06	State-machine/SCP CVEs; PRs 854 auth initialization, 857 string parsing, 856 worker/backpressure.
wolfSSH 1.5.0	2026-04-17 / 2026-04-20	Latest stable returned; parser/bounds, callback defaults, key cleanup, KEX ordering, Windows CVE.

Non-CVE findings are not automatically less important:

• wolfSSH PR 892 (fixed in 1.5.0): actual generated DoIgnore at line 5912 reads its length with unchecked ato32, ignores len, and advances by an unchecked peer length. DoServiceRequest at line 6124 also reads before checking; later service-name check does not establish four readable input bytes. Patch replaces these with bounded helpers. Password portion is already locally corrected, but the entire PR is not present.
• wolfSSH PR 881 (1.5.0): patch adds overflow check before peerWindowSz += bytesToAdd. Patch inspected; exact local function comparison was not completed. Potential availability/correctness issue, not a confirmed buffer overflow.
• wolfSSH PR 899 (1.5.0): patch bounds skips in ParseRSAPubKey/ParseECCPubKey and corrects DoChannelFailure length validation. Current role/reachability not finished; do not conflate client host-key parsing with server user-key authentication.
• wolfSSH PR 880 (1.5.0): release notes describe public-key type validation logical-operator correction. Actual generated DoUserAuthRequestEcc contains length mismatch AND memcmp mismatch checks for both key and signature type. This needs focused review with database key matching and attacker signature framing; exploit impact not established. Terminal-mode, agent, TPM, daemon changes in that PR need separate feature filtering.
• wolfSSH PRs 918/919/902 (1.5.0): forwarding/channel callback and payload hardening. FWD is absent; shell/exec/subsystem callbacks are registered, but default channel-open handling is not fully audited. No forwarding bypass claim.
• wolfSSL PR 10133 (5.9.1): ECC validation hardening. Actual wc_ecc_import_x963_ex calls wc_ecc_check_key only under absent WOLFSSL_VALIDATE_ECC_IMPORT. HAVE_ECC_CHECK_PUBKEY_ORDER is present inside ecc.c; its validation implementation can load curve B even without USE_ECC_B_PARAM. Do not infer “no point check anywhere” merely from absent B macro. Smallest candidate hardening is the upstream-recommended validation flag, pending full ECDH call trace and cost tests.
• wolfSSL 5.9.2: SP integer fixes, P521 SP ECDH 65/66-byte output check (PR 10702), DH subgroup hardening (PR 10560) are not current TFM/P256/no-DH features. Curve25519 all-zero-secret default checking (PR 10374), private-key clamp check (PR 10363), and broader ECC/EdDSA zeroization/validation fixes warrant follow-up. ESP port fixes in 5.9.1 PRs 10003/10080 need per-backend review; AES/hash hardware is disabled but that does not eliminate every ESP port path.

Remaining wolfSSL CVE inventory collected

All identifiers in this section have the prefix CVE-. Ranges are CNA metadata, not proof of local reachability; 0 means the record supplied no meaningful historical lower bound. Every listed record was successfully queried at https://cveawg.mitre.org/api/cve/<full-ID>. Fixed versions and trigger descriptions came from the official security page and ChangeLog. This is a compact screening inventory, not completed per-patch validation.

IDs	Published	Affected range / fixed	Current-feature screening
2025-11931	2025-11-21	<5.8.4 / 5.8.4	XChaCha API absent.
2025-11932, 2025-12889	2025-11-21	<5.8.4 / 5.8.4	wolfSSL TLS PSK/digest policy not used.
2025-11933, 2025-11934, 2025-11935, 2025-11936	2025-11-21	[3.12.0,5.8.4) / 5.8.4	wolfSSL TLS1.3 not used.
2026-0819	2026-03-19	[5.5.0,5.9.0) / 5.9.0	PKCS7 absent.
2026-1005, 2026-2646	2026-03-19	<=5.8.4 / 5.9.0	No wolfSSL sniffer/session restore use.
2026-2645	2026-03-19	<5.8.4 / 5.8.4; further 5.9.0 hardening	wolfSSL TLS1.2 server not used; table headline 5.9.0 must not obscure earlier effective fix.
2026-3229, 2026-3230, 2026-3547, 2026-3548, 2026-3549	2026-03-19	<5.9.0 / 5.9.0	Compatibility certificate APIs/TLS/CRL not current SSH features.
2026-3503	2026-03-19	[5.8.2,5.9.0) / 5.9.0	ARM Cortex-M PQ fault attack; wrong platform/features.
2026-3579, 2026-3580	2026-03-19	<5.9.0 / 5.9.0	RISC-V RV32I SP timing; wrong platform/math.
2026-3849	2026-03-19	5.6.0–5.8.4 inclusive / 5.9.0	HPKE/ECH TLS client not used.
2026-4159, 2026-4395	2026-03-19	<5.9.0; <=5.8.4, respectively / 5.9.0	PKCS7 / Linux KCAPI ECC not current features.
2026-5188	2026-04-10	<=5.9.0 / 5.9.1	Original ASN SAN parser; current template parser, no SSH certificates.
2026-5263, 2026-5264, 2026-5295, 2026-5392, 2026-5393, 2026-5447, 2026-5448, 2026-5460	2026-04-09	<5.9.1 / 5.9.1	Certificate constraints, DTLS, PKCS7, experimental dual certs, compatibility APIs or TLS PQ paths not used.
2026-5446	2026-04-09	[5.2.1,5.9.1) / 5.9.1	ARIA TLS not used.
2026-5466, 2026-5479	2026-04-10	<5.9.1 / 5.9.1	ECCSI / EVP ChaCha absent.
2026-5477, 2026-5500, 2026-5501	2026-04-10	<=5.9.0 / 5.9.1	EAX/CMAC >4GiB, PKCS7, compatibility X509 not used.
2026-5503, 2026-5504, 2026-5507, 2026-5772, 2026-5778	2026-04-09	<=5.9.0 / 5.9.1	ECH, PKCS7, session restore, hostname matcher, sniffer not used.
2026-10097	2026-06-25	[5.7.0,5.9.1] / 5.9.2	AVX2 ML-KEM; wrong platform/feature.
2026-10098	2026-06-25	[4.6.0,5.9.1] / 5.9.2	OCSP not used.
2026-10512	2026-06-25	[5.6.4,5.9.1] / 5.9.2	X25519 x86_64 assembly; wrong implementation.
2026-10592, 2026-6731, 2026-6412	2026-06-25	[3.9.10,5.9.1] / 5.9.2	Certificate name constraints/digest policy not current feature.
2026-11310	2026-06-25	[5.8.4,5.9.1] / 5.9.2	Pin predates introduction; compatibility X509 absent.
2026-11703	2026-06-25	[3.15.0,5.9.1] / 5.9.2	TLS SNI/ALPN resumption not used.
2026-11999, 2026-6091, 2026-55964	2026-06-25	[5.7.4,5.9.1] / 5.9.2	Certificate path verification not current feature.
2026-12340, 2026-55960	2026-06-25	[5.6.4,5.9.1] / 5.9.2	SM2 certificate/RPK TLS not used.
2026-55958	2026-06-25	[5.4.0,5.9.1] / 5.9.2	Renesas TSIP TLS; wrong platform.
2026-55961	2026-06-25	[3.15.7,5.9.1] / 5.9.2	Compatibility PKCS7 absent.
2026-55962	2026-06-25	[5.5.4,5.9.1] / 5.9.2	TLS post-handshake authentication not used.
2026-55967	2026-06-25	[4.8.0,5.9.1] / 5.9.2	GCM streaming >64GiB per message; streaming absent, not cumulative SSH session traffic.
2026-6092	2026-06-25	[5.2.0,5.9.1] / 5.9.2	TLS Encrypt-then-MAC not used.
2026-6094, 2026-7531	2026-06-25	[5.8.0,5.9.1] / 5.9.2	PKCS7 / TLS PQ hybrid not used.
2026-6291	2026-06-25	[3.9.10,5.9.1] / 5.9.2	PKCS7 RSA padding oracle, not SSH raw key authentication.
2026-6325	2026-06-25	[4.8.0,5.9.1] / 5.9.2	TLS signature-list setup not used.
2026-6329	2026-06-25	[3.10.0,5.9.1] / 5.9.2	PKCS12 MAC verification not a current SSH workflow.
2026-6330	2026-06-25	[5.7.4,5.9.1] / 5.9.2	ARM64 ML-KEM; wrong platform/feature.
2026-6331, 2026-6678, 2026-7511	2026-06-25	[3.15.5,5.9.1] / 5.9.2	EVP HMAC / PKCS7 APIs not used.
2026-6450	2026-06-25	[4.3.0,5.9.1] / 5.9.2	CRL not used.
2026-6679	2026-06-25	[5.4.0,5.9.0] / 5.9.1	DTLS not used. Listed under 5.9.2 but narrative says already fixed 5.9.1.
2026-6681	2026-06-25	[3.10.0,5.9.0] / 5.9.1	PKCS7 absent; same release-table/narrative discrepancy.
2026-7532	2026-06-25	<=5.9.1 / 5.9.2	X509 IP constraints not used. Related advisory ID TALOS-2026-2409 appears in upstream ChangeLog; Talos page not queried.
2026-8720	2026-06-25	[5.9.0,5.9.1] / 5.9.2	HMAC-BLAKE2 APIs introduced after pin.

Queried sources and caveats

All following requests occurred during this 2026-09-15 review. Network requests succeeded; no blocked-network limitation applies to collected external evidence. The last attempted local read/status command failed with authorization channel closed; no final repository status/diff validation was obtained.

Official index and release sources fetched:

• https://www.wolfssl.com/docs/security-vulnerabilities/
• https://github.com/wolfSSL/wolfssh/releases
• https://raw.githubusercontent.com/wolfSSL/wolfssh/master/ChangeLog.md
• https://raw.githubusercontent.com/wolfSSL/wolfssl/master/ChangeLog.md
• https://api.github.com/repos/wolfSSL/wolfssl/releases?per_page=6
• https://api.github.com/repos/wolfSSL/wolfssh/releases?per_page=6

Patch URLs actually queried (read only; no patch applied):

• https://github.com/wolfSSL/wolfssl/pull/9275.diff
• https://github.com/wolfSSL/wolfssl/pull/10131.diff
• https://github.com/wolfSSL/wolfssl/pull/10133.diff
• https://github.com/wolfSSL/wolfssl/pull/10025.diff
• https://github.com/wolfSSL/wolfssh/pull/855.diff
• https://github.com/wolfSSL/wolfssh/pull/892.diff
• https://github.com/wolfSSL/wolfssh/pull/881.diff
• https://github.com/wolfSSL/wolfssh/pull/899.diff

CVE metadata: exact URL construction is https://cveawg.mitre.org/api/cve/ followed by each full CVE identifier in the priority table and inventory above. Every such ID was queried; some twice. These are vendor CNA records served by the CVE API. Full paths are mechanically recoverable without search, e.g. https://cveawg.mitre.org/api/cve/CVE-2025-12888 and https://cveawg.mitre.org/api/cve/CVE-2025-14942 . No NVD or GitHub advisory API query was made.

Additional upstream patch links identified in release notes, not fetched: wolfSSH 840, 834, 859, 864, 793, 854, 856, 857, 880, 902, 918, 919, 921; wolfSSL 9148, 10003, 10080, 10363, 10374, 10560, 10702.

Evidence limitations:

• The consolidated official page omitted the four wolfSSH CVEs published with 1.4.21/1.4.22 despite listing older and newer entries. Neither that omission nor the user's earlier empty GitHub advisory tabs proves absence of vulnerabilities. GitHub advisory tabs were not re-queried here.
• Release-note dates differ from GitHub publication dates. CNA metadata has malformed ranges and conflicting references as noted. No date was inferred from a CVE year.
• Master ChangeLogs and PR diffs are mutable. Release tags/timestamps were queried, but upstream full commit hashes and archived evidence snapshots were not captured. Some long patch responses were output-limited; do not interpret a successful fetch as a complete hunk-by-hunk audit.
• Macro evidence is stronger than default Kconfig assumptions but not disassembly/timing evidence. Whole-library API reachability/linker elimination, every math/port fix, low-order X25519 behavior, RNG error paths, and ECC validation call chains remain unfinished.
• Older entries such as wolfSSH CVE-2024-2873 (fixed 1.4.17) were visible in the index; this report is focused on post-pin maintenance and does not certify every historical advisory.
• Parent follow-up: resolve the current-path priorities, choose a coherent upgrade/backport strategy, add negative message-order/parser/key-validation tests against actual generated sources, and run firmware plus whole-Phase-9 hardware gates. No hardware evidence is implied here.