PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted. The PKCS#12 verify path compared the locally computed HMAC against the MAC parsed from the PKCS#12 structure using a length taken directly from the attacker-supplied input, without first verifying that it equals the length of the digest actually produced by the configured algorithm. A truncated or zero-length stored MAC could therefore be accepted, defeating the integrity protection of the MAC.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460
    (released in 5.9.1): a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger
    the error cleanup path to operate on freed memory. (CVE-2026-7531)

  - Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted
    intermediate certificate rather than a trusted anchor. An attacker could present a chain that ends at an
    intermediate they control and have it accepted as valid. This affects the OpenSSL compatibility
    certificate-path-building path (wolfSSL_X509_verify_cert / X509_STORE, OPENSSL_EXTRA) when the
    X509_V_FLAG_PARTIAL_CHAIN verify flag is enabled. (CVE-2026-6091)

  - When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather
    than enforcing Encrypt-then-MAC. (CVE-2026-6092)

  - Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could
    theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS. (CVE-2026-6094)

  - Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA
    PKCS#1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding
    validation failed versus whether the decrypted content was malformed. An attacker able to submit crafted
    EnvelopedData messages and observe error responses could use this as a padding oracle to incrementally
    recover the encrypted Content Encryption Key (CEK). The fix generates a deterministic pseudo-random fake
    CEK on padding failure (via HMAC-SHA256) and proceeds with decryption identically, using constant-time
    operations throughout, so that all failure paths produce the same error regardless of padding validity.
    (CVE-2026-6291)

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4683 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4683-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     July 15, 2026                               https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : wolfssl     Version        : 5.5.4-2+deb12u3     CVE ID         : CVE-2026-5194 CVE-2026-6092 CVE-2026-6094 CVE-2026-6325                      CVE-2026-6329 CVE-2026-6331 CVE-2026-6450 CVE-2026-6678                      CVE-2026-6681 CVE-2026-6731 CVE-2026-7511 CVE-2026-55961                      CVE-2026-55962 CVE-2026-55967

    Multiple vulnerabilities were discovered in wolfSSL, a lightweight,     portable, C-language-based SSL/TLS library, which could result in     signature forgery, authentication bypass, information disclosure, or     denial of service.

    CVE-2026-5194

        Missing hash/digest size and OID checks allowed digests smaller         than appropriate for the relevant key type to be accepted during         ECDSA certificate signature verification, weakening ECDSA         certificate-based authentication when EdDSA or ML-DSA support was         also enabled.

    CVE-2026-6092

        When configured with HAVE_ENCRYPT_THEN_MAC, the TLS resumption path         could fall back to MAC-then-Encrypt instead of enforcing         Encrypt-then-MAC.

    CVE-2026-6094

        A heap buffer over-read in wc_PKCS7_DecodeEnvelopedData when parsing         crafted PKCS#7 EnvelopedData could be triggered by attacker-supplied         data delivered via S/MIME or CMS.

    CVE-2026-6325

        An out-of-bounds write in SetSuitesHashSigAlgo when processing an         oversized signature algorithms list allowed a write past the bounds         of the destination buffer.

    CVE-2026-6329

        PKCS#12 MAC verification compared the computed HMAC against the         stored MAC using an attacker-controlled length, allowing a truncated         or zero-length MAC to be accepted and defeating the integrity         protection of the MAC.

    CVE-2026-6331

        An HMAC zero-length tag forgery in EVP_DigestVerifyFinal allowed a         truncated or empty tag to be accepted as a valid signature, because         the supplied length was only checked not to exceed the MAC length.

    CVE-2026-6450

        A CRL critical extension bypass in ParseCRL_Extensions allowed a         crafted CRL carrying an unhandled critical extension to be accepted.
        This only affects builds with CRL support enabled.

    CVE-2026-6678

        An integer underflow in wc_PKCS7_DecryptOri when handling crafted         OtherRecipientInfo led to incorrect length handling during         decryption.

    CVE-2026-6681

        The PKCS#7 decode path ignored the caller-supplied output buffer         size (outputSz), allowing decoded content to be written past the         bounds of the provided buffer.

    CVE-2026-6731

        An X.509 name constraint bypass allowed a certificate whose Subject         Common Name violated an issuing CA's DNS name constraints to be         accepted when the CN was treated as a DNS-type name.

    CVE-2026-7511

        A PKCS7_verify signer confusion issue meant the signer associated         with a signature was not correctly bound, permitting a forged         signature to be accepted.

    CVE-2026-55961

        wolfSSL_PKCS7_verify() returned success for a degenerate         (certs-only) PKCS#7 object containing no signer, so a bundle         carrying no valid signature could be reported as verified. This         only affects OpenSSL compatibility builds.

    CVE-2026-55962

        A TLS 1.3 post-handshake authentication issue allowed a server to         accept a client's Finished message without the client having sent a         Certificate and CertificateVerify. This only affects TLS 1.3         servers configured with and actively using post-handshake         authentication.

    CVE-2026-55967

        AES-GCM encryption/decryption with extremely large cumulative single         message sizes (>64 GiB) were not properly rejected by the streaming         APIs, allowing counter wrap, keystream reuse and consequent         plaintext recovery.

    For Debian 12 bookworm, these problems have been fixed in version     5.5.4-2+deb12u3.

    We recommend that you upgrade your wolfssl packages.

    For the detailed security status of wolfssl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/wolfssl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on     the MAC and allowing a mismatched MAC to be accepted. The PKCS#12 verify path compared the locally     computed HMAC against the MAC parsed from the PKCS#12 structure using a length taken directly from the     attacker-supplied input, without first verifying that it equals the length of the digest actually produced     by the configured algorithm. A truncated or zero-length stored MAC could therefore be accepted, defeating     the integrity protection of the MAC. (CVE-2026-6329)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474886	Alpine: multiple wolfssl packages: security update to 5.9.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
474886	Alpine: multiple wolfssl packages: security update to 5.9.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
326925	Debian dla-4683 : libwolfssl-dev - security update	Nessus	Debian Local Security Checks	Local	critical
323808	Linux Distros Unpatched Vulnerability : CVE-2026-6329	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-6329

medium

Tenable Plugins

high

high

critical

medium