Alpine: multiple wolfssl packages: security update to 5.9.2-r0

high Tenable Cloud Security Plugin ID 474886

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460
(released in 5.9.1): a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger
the error cleanup path to operate on freed memory. (CVE-2026-7531)

- Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted
intermediate certificate rather than a trusted anchor. An attacker could present a chain that ends at an
intermediate they control and have it accepted as valid. This affects the OpenSSL compatibility
certificate-path-building path (wolfSSL_X509_verify_cert / X509_STORE, OPENSSL_EXTRA) when the
X509_V_FLAG_PARTIAL_CHAIN verify flag is enabled. (CVE-2026-6091)

- When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt rather
than enforcing Encrypt-then-MAC. (CVE-2026-6092)

- Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could
theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS. (CVE-2026-6094)

- Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA
PKCS#1 v1.5 key transport, wolfSSL returned distinguishable error codes depending on whether RSA padding
validation failed versus whether the decrypted content was malformed. An attacker able to submit crafted
EnvelopedData messages and observe error responses could use this as a padding oracle to incrementally
recover the encrypted Content Encryption Key (CEK). The fix generates a deterministic pseudo-random fake
CEK on padding failure (via HMAC-SHA256) and proceeds with decryption identically, using constant-time
operations throughout, so that all failure paths produce the same error regardless of padding validity.
(CVE-2026-6291)

Solution

Update the wolfssl library and its related packages to version 5.9.2-r0 or later.

Plugin Details

Severity: High

ID: 474886

Version: Revision 1.2

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.03

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-7531

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.8

Threat Score: 6.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-6679

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/25/2026

Reference Information

CVE: CVE-2026-10097, CVE-2026-10098, CVE-2026-10512, CVE-2026-10592, CVE-2026-11310, CVE-2026-11703, CVE-2026-11999, CVE-2026-12340, CVE-2026-55958, CVE-2026-55960, CVE-2026-55961, CVE-2026-55962, CVE-2026-55964, CVE-2026-55967, CVE-2026-6091, CVE-2026-6092, CVE-2026-6094, CVE-2026-6291, CVE-2026-6325, CVE-2026-6329, CVE-2026-6330, CVE-2026-6331, CVE-2026-6412, CVE-2026-6450, CVE-2026-6678, CVE-2026-6679, CVE-2026-6681, CVE-2026-6731, CVE-2026-7511, CVE-2026-7531, CVE-2026-7532, CVE-2026-8720

Detections

Analytics