Commander1024
c010e1a1d5
- Add fail-closed wolfSSL small-math policy and vectors - Backport DHCP, EMS, and X.509 allocation fixes - Extend source override validation and operational documentation
26 KiB
Phase 9D — wolfSSL / wolfSSH advisory review (partial)
Implementation addendum — 2026-09-15
Xtensa small-math mitigation implemented; the broader review and security sign-off remain open. Root CMakeLists.txt defines CURVE25519_SMALL and ED25519_SMALL before component parsing. cmake/wolf_crypto_policy.cmake propagates a forced-include resolved-settings guard PUBLIC from wolfSSL to consumers, including wolfSSH/application code. cmake/wolf_crypto_policy.h requires both enabled small implementations, rejects WOLFSSL_CURVE25519_BLINDING, and rejects enabling Curve448/Ed448 without review. This follows PR 9275's small-math policy for the enabled Xtensa algorithms, with consistent library/consumer production flags and ABI-sensitive layouts. Blinding is not enabled with small X25519: wolfSSL 5.8.2 excludes/rejects this combination; do not force it back on or present the historical blinding observation below as current policy.
The CVE-2025-12888 configuration mitigation is no longer merely proposed. Supplied parent evidence: pio run PASS, 94,340 B linked RAM / 1,767,217 B flash, −64,092 B flash from 9C with unchanged linked RAM; all four focused mitigation commands passed. Independent reviewer reports SDK-override and wolf-crypto-policy tests passed with no blocking implementation defects. These are supplied host/build results, not reruns by this documentation update, device timing measurements, real SSH interoperability/rekey evidence or runtime-headroom evidence.
Still pending: coherent wolfSSH message-order review/correction (CVE-2025-14942), IGNORE/service and other parser review, ECC import/ECDH/raw-signature validation review, remaining advisory applicability, and whole-phase target validation. No dependency upgrades were made; newer release pairs below remain unvalidated candidates. License/source/notice packaging remains unresolved in the license inventory. Phase 9 is not complete or production-ready.
Historical pre-mitigation research baseline — 2026-09-15
The remainder retains the original research evidence. “Current” macros, generated hashes and “not applied/tested” statements below refer to the earlier non-small snapshot; the addendum supersedes those implementation-status claims only. The pending ordering/parser/ECC findings are not closed.
Review date: 2026-09-15. Read-only external research and local applicability inspection; stopped at the user's requested handoff. Not a completed security review or release clearance. Only this new report was written. No dependencies, sources, generated inputs, or parent documents were changed; no build, hardware test, network exploit, or public PoC was executed.
Release decision / current-path priorities
- Block security sign-off pending mitigation of CVE-2025-12888. Current SSH advertises X25519 on Xtensa, and actual compiler preprocessing confirms the affected non-small implementation. Upstream recommends the small implementation; existing blinding is not evidence that this separate compiler/architecture issue is resolved. Exploitability on this precise GCC/optimization/device combination was not measured.
- Block sign-off pending a reviewed wolfSSH message-order correction. CVE-2025-14942 is critical for clients; upstream explicitly recommends its fix for servers because the same defect exists, without identifying a specific server attack. The generated local server state machine lacks the fix. Do not report demonstrated server password disclosure or authentication bypass from this evidence.
- Close current-path parser gaps before sign-off. Upstream wolfSSH PR 892 fixes unchecked SSH_IGNORE/service-string parsing still present in the generated source. These are security-relevant malformed-input handling defects, not assigned CVEs in the inspected release notes. Actual out-of-allocation access/exploit impact remains unproven: packet padding and enclosing receive-buffer invariants need auditing. Phase 9C's password fix does not fix these handlers.
- Keep ECC validation and other non-CVE hardening open. Current ECC import lacks
WOLFSSL_VALIDATE_ECC_IMPORT; 5.9.1 release notes explicitly recommend this flag for older versions. Whether the SSH ECDH path already performs equivalent validation before scalar multiplication was not resolved. Do not call this a confirmed invalid-curve vulnerability.
Smallest proposed mitigation for item 1: enable CURVE25519_SMALL consistently for library and consumers through project-owned compile policy; upstream PR 9275 also enables ED25519_SMALL, CURVE448_SMALL, and ED448_SMALL on Xtensa. For enabled algorithms, follow that upstream policy rather than assume X25519 blinding suffices. Check the effective blinding/small combination, ABI, compile guards, performance, and real SSH interoperability. This was not applied or tested.
Item 2 is not a safe one-line patch. PR 855 changes internal.c, handshake layout in wolfssh/internal.h, message ranges, expected-message tracking, and logging; 1.4.20 also predates intervening rekey changes. A backport needs the coherent library/header change set, audit of prerequisites, and later PR 921 follow-up noted in 1.5.0. Prefer evaluating wolfSSH 1.5.0 + wolfSSL 5.9.2, the newest stable releases returned by the queried APIs, rather than merely reaching the minimum fixed release. This is a candidate pair, not verified ESP managed-component availability or compatibility. Any upgrade requires rebasing exact-hash Phase 9C overrides, auth/version guards, callback changes (including keyboard auth), and contract tests; do not blindly repin.
For item 3 the smallest candidate backport is the bounded GetSkip/GetString handling from PR 892, including necessary helper semantics, plus regression cases for truncated/oversized/wrapping lengths. Preserve Phase 9C password framing and wiping. No backport has been proven safe by this report.
Local evidence and effective policy
dependencies.lock:wolfssl/wolfssl5.8.2~1 (upstream 5.8.2), component hash4d619e882c19d967bbaa53302e3bd2bdb8c611b5efb13302171aace809fccfdf;wolfssl/wolfssh1.4.20, component hash24d623360c07374a90b1ade8d1218b24bb7b661fd51ace9135dccf510a338927.- Actual database:
.pio/build/esp32-s3-devkitc-1-n16r8/compile_commands.json. Replayed four actual compiler commands with-E -dM, removing compilation/output/dependency-write flags, capturing stdout only: wolfCryptecc.c,curve25519.c,random.c, and generated wolfSSHsecurity_overrides/wolfssh_internal/internal.c. All four preprocessing invocations returned 0. This is current compile-policy evidence, not proof the flashed binary matches it. - Compiler:
xtensa-esp32s3-elf-gcc,__GNUC__=14,__GNUC_MINOR__=2,__XTENSA__=1; representative wolfCrypt commands use-Og. - Generated wolfSSH input SHA-256:
1c04d26d46f7bef61eefcf0b78c43742662001bf6054ad2383500c9063c62494.tools/security_overrides.pypins originalinternal.cSHA-25681ff1f9166708abd5c2911e9fe57c0aee01c88b5d3f68c909ee8a856d37f36a9; edits bound both password lengths withGetSize, prevent malformed new-password framing reaching the callback, and wipe the checked method suffix. No message-order or IGNORE/service parsing correction appears in those edits. src/ssh_protocol_policy.c: KEXcurve25519-sha256,ecdh-sha2-nistp256; host keyecdsa-sha2-nistp256; ciphers AES-128/256-GCM; MAC advertisement HMAC-SHA256; user-key advertisement Ed25519/P256. Database authorization remains separate from advertisement.src/ssh_transport.c: createsWOLFSSH_ENDPOINT_SERVER; sets authentication callbacks, explicit keyboard rejection, shell acceptance, and exec/subsystem rejection. Project memory identifies wolfCrypt as SSH crypto, not the HTTPS provider. However,WOLFCRYPT_ONLYandNO_TLSare absent in the actual macros: “used only for crypto” must not be mislabeled “TLS compiled out.” No duplicate IDF/mbedTLS advisory assessment is made here.
| Area | Effective observations | Consequence |
|---|---|---|
| Math | USE_FAST_MATH present; WOLFSSL_SP_MATH, WOLFSSL_SP_MATH_ALL, WOLFSSL_HAVE_SP_ECC, WOLFSSL_HAVE_SP_DH, WOLFSSL_SP_NONBLOCK absent |
TFM, not SP. SP-specific release fixes are not automatically current-path findings. |
| DH | NO_DH present; generated SSH also has WOLFSSH_NO_DH |
Finite-field DH and SSH DH-GEX fixes are not current negotiated features. ECDH is distinct and remains enabled. |
| ECC | HAVE_ECC, ECC_TIMING_RESISTANT, HAVE_ECC_CHECK_KEY present; WOLFSSL_VALIDATE_ECC_IMPORT, USE_ECC_B_PARAM absent; HAVE_ECC_CHECK_PUBKEY_ORDER appears in ecc.c after its internal includes |
A compiled key-check implementation is not proof callers invoke it. ecc.c:10993–10996 gates import-time checking on the absent validation flag. |
| X25519 / Ed25519 | HAVE_CURVE25519, HAVE_ED25519, WOLFSSL_CURVE25519_BLINDING present; CURVE25519_SMALL, ED25519_SMALL absent |
CVE-2025-12888 configuration matches; earlier blinding hardening is enabled. |
| RNG | HAVE_HASHDRBG, WC_RNG_SEED_CB present; custom generate-block/seed macros absent; wc_SetSeed_Cb(ssh_seed) registration observed |
Project callback supplies wolfCrypt Hash-DRBG seeding. Do not confuse this with OpenSSL RAND-after-fork or claim entropy quality was tested. |
| AES / hardware | HAVE_AESGCM present; streaming GCM absent; ESP32 crypto port present, hardware AES/hash explicitly disabled; RSA hardware-disable macro absent |
Current AES/hash software policy is intentional. Not an all-software-crypto claim. |
| Optional APIs | HAVE_PKCS7, HAVE_ECCSI, HAVE_CHACHA, HAVE_XCHACHA, HAVE_POLY1305, OPENSSL_EXTRA absent; ASN template present/original absent |
Many crypto-only advisories still need feature/API filtering, not just TLS exclusion. |
| SSH features | WOLFSSH_CERTS, WOLFSSH_SFTP, WOLFSSH_SCP, WOLFSSH_FWD, WOLFSSH_AGENT absent; NO_WOLFSSH_CLIENT absent |
No certificate/file-transfer/forwarding feature; client code not compile-disabled, but inspected application is server-only. |
Priority advisory evidence table
Dates below are CVE record publication dates (UTC), not reservation or release dates. Upstream severity does not by itself establish local exploitability. Source URLs are listed below.
| ID / upstream severity | Published | Affected / fixed upstream | Local applicability and evidence |
|---|---|---|---|
| CVE-2025-12888 / Low | 2025-11-21 | <5.8.4; fixed 5.8.4, wolfSSL PR 9275 |
Applicable configuration, immediate mitigation priority. Xtensa + advertised X25519 + small implementation absent. Patch inspected. |
| CVE-2025-14942 / Critical (client) | 2026-01-06 | <1.4.22; fixed 1.4.22, wolfSSH PR 855 |
Potential server impact / upstream recommends server fix. Generated internal.c:587–623 has old accept-state filtering, no expected-message tracking. Critical client credential-leak scenario is not this application's role. |
| CVE-2025-11625 / Critical | 2025-10-21 | <=1.4.20 client; fixed 1.4.21, PR 840 |
Not current role. Host-verification bypass/credential leak concerns wolfSSH clients. CNA version string is malformed (1.4.20;0); range taken from official release notes. |
| CVE-2025-11624 / Medium | 2025-10-21 | 1.3.0–1.4.20 inclusive; fixed 1.4.21, PR 834 | Not current feature. SFTP file-handle stack overflow; SFTP absent. |
| CVE-2025-15382 / Medium | 2026-01-06 | Release notes: 1.4.12–1.4.21 inclusive; fixed 1.4.22, PR 859 | Not current feature. SCP clean-path overread. CNA incorrectly/differently says <1.4.21; use conservative release-note range and retain discrepancy. |
| CVE-2026-0930 / Low | 2026-04-20 | 1.4.15–<1.5.0; fixed 1.5.0 |
Not current platform/application. Windows wolfSSHd terminal resize. Release notes name PR 864; CNA references PR 846 instead. Discrepancy not resolved. |
| CVE-2026-5194 / Critical | 2026-04-09 | 3.12.0–<5.9.1; fixed 5.9.1, wolfSSL PR 10131 |
Not demonstrated on current SSH flow. Certificate OID/type confusion absent without SSH certificates. Patch also hardens low-level ECC digest lengths, so crypto-only use is not a blanket exclusion. Inspected SSH paths derive digest sizes from hash IDs; finish tracing every current raw-signature call before closure. |
| CVE-2026-5187 / Low | 2026-04-09 | <=5.9.0; fixed 5.9.1, PR 10025 |
No current trigger established. DecodeObjectId/unknown ASN.1 extension handling; raw SSH keys are not X.509 extensions. ASN is compiled for keys/signatures, so retain API reachability check rather than claim all ASN parsing absent. |
| CVE-2025-13912 / Low | 2025-12-11 | <5.8.4; fixed 5.8.4, PR 9148 |
Not reported compiler/architecture combination. Advisory describes Clang on AArch64/RISC-V/x86_64; current GCC14.2 Xtensa. Separate from CVE-2025-12888. |
| CVE-2025-7396 / Low | 2025-07-18 | Blinding introduced 5.8.0, enabled by default in applicable 5.8.2 builds | Existing mitigation present: actual WOLFSSL_CURVE25519_BLINDING. CNA affected string 5.8.0; 0 is not a usable precise range. Not a resolution of the Xtensa advisory. |
Post-pin release review, including changes without CVEs
| Product / version | Release-note date / GitHub publication UTC date | Scope checked |
|---|---|---|
| wolfSSL 5.8.4 | 2025-11-20 / 2025-11-21 | Xtensa small implementations, Clang hardening, TLS advisories, ESP SHA changes. |
| wolfSSL 5.9.0 | 2026-03-18 / 2026-03-19 | TLS/PKCS/CRL advisories; RISC-V SP timing, KCAPI ECC import, RNG/port changes. |
| wolfSSL 5.9.1 | 2026-04-08 / 2026-04-08 | Certificate/digest checks; ECC import validation; SP and hardware-port hardening. |
| wolfSSL 5.9.2 | 2026-06-23 / 2026-06-25 | Latest stable returned; additional crypto validation, zeroization, SP/DH, PKCS, TLS and platform fixes. Unreleased master material is not a release candidate. |
| wolfSSH 1.4.21 | 2025-10-20 / 2025-10-22 | Client/SFTP CVEs; rekey PR 793, auth rejection fixes, keyboard callback changes. |
| wolfSSH 1.4.22 | 2026-01-05 / 2026-01-06 | State-machine/SCP CVEs; PRs 854 auth initialization, 857 string parsing, 856 worker/backpressure. |
| wolfSSH 1.5.0 | 2026-04-17 / 2026-04-20 | Latest stable returned; parser/bounds, callback defaults, key cleanup, KEX ordering, Windows CVE. |
Non-CVE findings are not automatically less important:
- wolfSSH PR 892 (fixed in 1.5.0): actual generated
DoIgnoreat line 5912 reads its length with uncheckedato32, ignoreslen, and advances by an unchecked peer length.DoServiceRequestat line 6124 also reads before checking; later service-name check does not establish four readable input bytes. Patch replaces these with bounded helpers. Password portion is already locally corrected, but the entire PR is not present. - wolfSSH PR 881 (1.5.0): patch adds overflow check before
peerWindowSz += bytesToAdd. Patch inspected; exact local function comparison was not completed. Potential availability/correctness issue, not a confirmed buffer overflow. - wolfSSH PR 899 (1.5.0): patch bounds skips in
ParseRSAPubKey/ParseECCPubKeyand correctsDoChannelFailurelength validation. Current role/reachability not finished; do not conflate client host-key parsing with server user-key authentication. - wolfSSH PR 880 (1.5.0): release notes describe public-key type validation logical-operator correction. Actual generated
DoUserAuthRequestEcccontains length mismatch ANDmemcmpmismatch checks for both key and signature type. This needs focused review with database key matching and attacker signature framing; exploit impact not established. Terminal-mode, agent, TPM, daemon changes in that PR need separate feature filtering. - wolfSSH PRs 918/919/902 (1.5.0): forwarding/channel callback and payload hardening. FWD is absent; shell/exec/subsystem callbacks are registered, but default channel-open handling is not fully audited. No forwarding bypass claim.
- wolfSSL PR 10133 (5.9.1): ECC validation hardening. Actual
wc_ecc_import_x963_excallswc_ecc_check_keyonly under absentWOLFSSL_VALIDATE_ECC_IMPORT.HAVE_ECC_CHECK_PUBKEY_ORDERis present insideecc.c; its validation implementation can load curve B even withoutUSE_ECC_B_PARAM. Do not infer “no point check anywhere” merely from absent B macro. Smallest candidate hardening is the upstream-recommended validation flag, pending full ECDH call trace and cost tests. - wolfSSL 5.9.2: SP integer fixes, P521 SP ECDH 65/66-byte output check (PR 10702), DH subgroup hardening (PR 10560) are not current TFM/P256/no-DH features. Curve25519 all-zero-secret default checking (PR 10374), private-key clamp check (PR 10363), and broader ECC/EdDSA zeroization/validation fixes warrant follow-up. ESP port fixes in 5.9.1 PRs 10003/10080 need per-backend review; AES/hash hardware is disabled but that does not eliminate every ESP port path.
Remaining wolfSSL CVE inventory collected
All identifiers in this section have the prefix CVE-. Ranges are CNA metadata, not proof of local reachability; 0 means the record supplied no meaningful historical lower bound. Every listed record was successfully queried at https://cveawg.mitre.org/api/cve/<full-ID>. Fixed versions and trigger descriptions came from the official security page and ChangeLog. This is a compact screening inventory, not completed per-patch validation.
| IDs | Published | Affected range / fixed | Current-feature screening |
|---|---|---|---|
| 2025-11931 | 2025-11-21 | <5.8.4 / 5.8.4 |
XChaCha API absent. |
| 2025-11932, 2025-12889 | 2025-11-21 | <5.8.4 / 5.8.4 |
wolfSSL TLS PSK/digest policy not used. |
| 2025-11933, 2025-11934, 2025-11935, 2025-11936 | 2025-11-21 | [3.12.0,5.8.4) / 5.8.4 |
wolfSSL TLS1.3 not used. |
| 2026-0819 | 2026-03-19 | [5.5.0,5.9.0) / 5.9.0 |
PKCS7 absent. |
| 2026-1005, 2026-2646 | 2026-03-19 | <=5.8.4 / 5.9.0 |
No wolfSSL sniffer/session restore use. |
| 2026-2645 | 2026-03-19 | <5.8.4 / 5.8.4; further 5.9.0 hardening |
wolfSSL TLS1.2 server not used; table headline 5.9.0 must not obscure earlier effective fix. |
| 2026-3229, 2026-3230, 2026-3547, 2026-3548, 2026-3549 | 2026-03-19 | <5.9.0 / 5.9.0 |
Compatibility certificate APIs/TLS/CRL not current SSH features. |
| 2026-3503 | 2026-03-19 | [5.8.2,5.9.0) / 5.9.0 |
ARM Cortex-M PQ fault attack; wrong platform/features. |
| 2026-3579, 2026-3580 | 2026-03-19 | <5.9.0 / 5.9.0 |
RISC-V RV32I SP timing; wrong platform/math. |
| 2026-3849 | 2026-03-19 | 5.6.0–5.8.4 inclusive / 5.9.0 | HPKE/ECH TLS client not used. |
| 2026-4159, 2026-4395 | 2026-03-19 | <5.9.0; <=5.8.4, respectively / 5.9.0 |
PKCS7 / Linux KCAPI ECC not current features. |
| 2026-5188 | 2026-04-10 | <=5.9.0 / 5.9.1 |
Original ASN SAN parser; current template parser, no SSH certificates. |
| 2026-5263, 2026-5264, 2026-5295, 2026-5392, 2026-5393, 2026-5447, 2026-5448, 2026-5460 | 2026-04-09 | <5.9.1 / 5.9.1 |
Certificate constraints, DTLS, PKCS7, experimental dual certs, compatibility APIs or TLS PQ paths not used. |
| 2026-5446 | 2026-04-09 | [5.2.1,5.9.1) / 5.9.1 |
ARIA TLS not used. |
| 2026-5466, 2026-5479 | 2026-04-10 | <5.9.1 / 5.9.1 |
ECCSI / EVP ChaCha absent. |
| 2026-5477, 2026-5500, 2026-5501 | 2026-04-10 | <=5.9.0 / 5.9.1 |
EAX/CMAC >4GiB, PKCS7, compatibility X509 not used. |
| 2026-5503, 2026-5504, 2026-5507, 2026-5772, 2026-5778 | 2026-04-09 | <=5.9.0 / 5.9.1 |
ECH, PKCS7, session restore, hostname matcher, sniffer not used. |
| 2026-10097 | 2026-06-25 | [5.7.0,5.9.1] / 5.9.2 |
AVX2 ML-KEM; wrong platform/feature. |
| 2026-10098 | 2026-06-25 | [4.6.0,5.9.1] / 5.9.2 |
OCSP not used. |
| 2026-10512 | 2026-06-25 | [5.6.4,5.9.1] / 5.9.2 |
X25519 x86_64 assembly; wrong implementation. |
| 2026-10592, 2026-6731, 2026-6412 | 2026-06-25 | [3.9.10,5.9.1] / 5.9.2 |
Certificate name constraints/digest policy not current feature. |
| 2026-11310 | 2026-06-25 | [5.8.4,5.9.1] / 5.9.2 |
Pin predates introduction; compatibility X509 absent. |
| 2026-11703 | 2026-06-25 | [3.15.0,5.9.1] / 5.9.2 |
TLS SNI/ALPN resumption not used. |
| 2026-11999, 2026-6091, 2026-55964 | 2026-06-25 | [5.7.4,5.9.1] / 5.9.2 |
Certificate path verification not current feature. |
| 2026-12340, 2026-55960 | 2026-06-25 | [5.6.4,5.9.1] / 5.9.2 |
SM2 certificate/RPK TLS not used. |
| 2026-55958 | 2026-06-25 | [5.4.0,5.9.1] / 5.9.2 |
Renesas TSIP TLS; wrong platform. |
| 2026-55961 | 2026-06-25 | [3.15.7,5.9.1] / 5.9.2 |
Compatibility PKCS7 absent. |
| 2026-55962 | 2026-06-25 | [5.5.4,5.9.1] / 5.9.2 |
TLS post-handshake authentication not used. |
| 2026-55967 | 2026-06-25 | [4.8.0,5.9.1] / 5.9.2 |
GCM streaming >64GiB per message; streaming absent, not cumulative SSH session traffic. |
| 2026-6092 | 2026-06-25 | [5.2.0,5.9.1] / 5.9.2 |
TLS Encrypt-then-MAC not used. |
| 2026-6094, 2026-7531 | 2026-06-25 | [5.8.0,5.9.1] / 5.9.2 |
PKCS7 / TLS PQ hybrid not used. |
| 2026-6291 | 2026-06-25 | [3.9.10,5.9.1] / 5.9.2 |
PKCS7 RSA padding oracle, not SSH raw key authentication. |
| 2026-6325 | 2026-06-25 | [4.8.0,5.9.1] / 5.9.2 |
TLS signature-list setup not used. |
| 2026-6329 | 2026-06-25 | [3.10.0,5.9.1] / 5.9.2 |
PKCS12 MAC verification not a current SSH workflow. |
| 2026-6330 | 2026-06-25 | [5.7.4,5.9.1] / 5.9.2 |
ARM64 ML-KEM; wrong platform/feature. |
| 2026-6331, 2026-6678, 2026-7511 | 2026-06-25 | [3.15.5,5.9.1] / 5.9.2 |
EVP HMAC / PKCS7 APIs not used. |
| 2026-6450 | 2026-06-25 | [4.3.0,5.9.1] / 5.9.2 |
CRL not used. |
| 2026-6679 | 2026-06-25 | [5.4.0,5.9.0] / 5.9.1 |
DTLS not used. Listed under 5.9.2 but narrative says already fixed 5.9.1. |
| 2026-6681 | 2026-06-25 | [3.10.0,5.9.0] / 5.9.1 |
PKCS7 absent; same release-table/narrative discrepancy. |
| 2026-7532 | 2026-06-25 | <=5.9.1 / 5.9.2 |
X509 IP constraints not used. Related advisory ID TALOS-2026-2409 appears in upstream ChangeLog; Talos page not queried. |
| 2026-8720 | 2026-06-25 | [5.9.0,5.9.1] / 5.9.2 |
HMAC-BLAKE2 APIs introduced after pin. |
Queried sources and caveats
All following requests occurred during this 2026-09-15 review. Network requests succeeded; no blocked-network limitation applies to collected external evidence. The last attempted local read/status command failed with authorization channel closed; no final repository status/diff validation was obtained.
Official index and release sources fetched:
- https://www.wolfssl.com/docs/security-vulnerabilities/
- https://github.com/wolfSSL/wolfssh/releases
- https://raw.githubusercontent.com/wolfSSL/wolfssh/master/ChangeLog.md
- https://raw.githubusercontent.com/wolfSSL/wolfssl/master/ChangeLog.md
- https://api.github.com/repos/wolfSSL/wolfssl/releases?per_page=6
- https://api.github.com/repos/wolfSSL/wolfssh/releases?per_page=6
Patch URLs actually queried (read only; no patch applied):
- https://github.com/wolfSSL/wolfssl/pull/9275.diff
- https://github.com/wolfSSL/wolfssl/pull/10131.diff
- https://github.com/wolfSSL/wolfssl/pull/10133.diff
- https://github.com/wolfSSL/wolfssl/pull/10025.diff
- https://github.com/wolfSSL/wolfssh/pull/855.diff
- https://github.com/wolfSSL/wolfssh/pull/892.diff
- https://github.com/wolfSSL/wolfssh/pull/881.diff
- https://github.com/wolfSSL/wolfssh/pull/899.diff
CVE metadata: exact URL construction is https://cveawg.mitre.org/api/cve/ followed by each full CVE identifier in the priority table and inventory above. Every such ID was queried; some twice. These are vendor CNA records served by the CVE API. Full paths are mechanically recoverable without search, e.g. https://cveawg.mitre.org/api/cve/CVE-2025-12888 and https://cveawg.mitre.org/api/cve/CVE-2025-14942 . No NVD or GitHub advisory API query was made.
Additional upstream patch links identified in release notes, not fetched: wolfSSH 840, 834, 859, 864, 793, 854, 856, 857, 880, 902, 918, 919, 921; wolfSSL 9148, 10003, 10080, 10363, 10374, 10560, 10702.
Evidence limitations:
- The consolidated official page omitted the four wolfSSH CVEs published with 1.4.21/1.4.22 despite listing older and newer entries. Neither that omission nor the user's earlier empty GitHub advisory tabs proves absence of vulnerabilities. GitHub advisory tabs were not re-queried here.
- Release-note dates differ from GitHub publication dates. CNA metadata has malformed ranges and conflicting references as noted. No date was inferred from a CVE year.
- Master ChangeLogs and PR diffs are mutable. Release tags/timestamps were queried, but upstream full commit hashes and archived evidence snapshots were not captured. Some long patch responses were output-limited; do not interpret a successful fetch as a complete hunk-by-hunk audit.
- Macro evidence is stronger than default Kconfig assumptions but not disassembly/timing evidence. Whole-library API reachability/linker elimination, every math/port fix, low-order X25519 behavior, RNG error paths, and ECC validation call chains remain unfinished.
- Older entries such as wolfSSH CVE-2024-2873 (fixed 1.4.17) were visible in the index; this report is focused on post-pin maintenance and does not certify every historical advisory.
- Parent follow-up: resolve the current-path priorities, choose a coherent upgrade/backport strategy, add negative message-order/parser/key-validation tests against actual generated sources, and run firmware plus whole-Phase-9 hardware gates. No hardware evidence is implied here.