CVE-2026-8720
HMAC-BLAKE2 final discards message when key length exceeds block size
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
HMAC-BLAKE2 final discards message when key length exceeds block size
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.
- Record
CVE-2026-8720- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-354
- Updated
- 2026-11-02
EUVDEUVD-2026-39579
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.
- Record
EUVD-2026-39579- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-34qm-63x6-fcm3
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the...
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.
- Record
GHSA-34qm-63x6-fcm3- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-354
- Updated
- 2026-11-02
NVD
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.
- Record
CVE-2026-8720- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-354
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-8720
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.
- Record
ALPINE-CVE-2026-8720- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSV
HMAC-BLAKE2 final discards message when key length exceeds block size
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.
- Record
CVE-2026-8720- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-354
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-8720
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.
- Record
DEBIAN-CVE-2026-8720- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-8720
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.
- Record
UBUNTU-CVE-2026-8720- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wolfsslAlpine:v3.24 |
5.9.0 up to 5.9.2-r0 | 5.9.2-r0 |
wolfsslDebian:12 |
All versions, plus listed versions 5.5.4-25.5.4-2+deb12u15.5.4-2+deb12u25.5.4-2+deb12u35.5.4-2.1 Show 22 moreShow less5.6.4-15.6.4-25.6.6-15.6.6-1.15.6.6-1.25.6.6-1.35.6.6-1.3~exp15.7.0-0.15.7.0-0.25.7.0-0.35.7.2-0.15.7.2-0.25.7.2-0.35.7.2-0.45.8.2-15.8.2-1.15.8.2-1.25.8.4-15.9.0-0.15.9.0-0.25.9.1-0.15.9.2-1 |
None known |
wolfsslDebian:13 |
All versions, plus listed versions 5.7.2-0.15.7.2-0.1+deb13u15.7.2-0.1+deb13u25.7.2-0.25.7.2-0.3 Show 9 moreShow less5.7.2-0.45.8.2-15.8.2-1.15.8.2-1.25.8.4-15.9.0-0.15.9.0-0.25.9.1-0.15.9.2-1 |
None known |
wolfsslUbuntu:16.04:LTS |
All versions, plus listed versions 3.4.8+dfsg-1 |
None known |
wolfsslUbuntu:18.04:LTS |
All versions, plus listed versions 3.10.2+dfsg-23.12.0+dfsg-13.12.2+dfsg-13.13.0+dfsg-1 |
None known |
wolfsslUbuntu:20.04:LTS |
All versions, plus listed versions 4.1.0+dfsg-24.2.0+dfsg-14.2.0+dfsg-24.2.0+dfsg-34.3.0+dfsg-2 |
None known |
wolfsslUbuntu:22.04:LTS |
All versions, plus listed versions 4.6.0-35.0.0-15.1.1-15.2.0-15.2.0-2 |
None known |
wolfsslUbuntu:24.04:LTS |
All versions, plus listed versions 5.5.4-25.5.4-2.15.6.4-25.6.6-1.25.6.6-1.35.6.6-1.3build1 |
None known |
wolfsslUbuntu:25.10 |
All versions, plus listed versions 5.7.2-0.1 |
None known |
wolfsslUbuntu:26.10 |
All versions, plus listed versions 5.9.1-0.15.9.2-1 |
None known |
wolfsslUbuntu:26.04:LTS |
All versions, plus listed versions 5.7.2-0.15.8.2-1.25.8.4-15.9.1-0.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-8720 is a medium vulnerability (CVSS 5.9) in Wolfssl, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in wolfssl 5.9.2-r0.