CVE-2026-16516: wolfSSH 0 through 1.5.0; status changes: 1.6.0 — unaffected

Affected technology

wolfSSH · 0 through 1.5.0; status changes: 1.6.0 — unaffected
wolfSSL Inc.

Component: Not specified by the source
File: src/internal.c

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Vendor/CNA’s CVSS 4.0 assessment (base score 9.0/10) rates confidentiality impact as low; integrity impact as high; availability impact as none.