{"id":"CVE-2026-81535","revision":"2c4acb2051754daa932bb5c5b7753290","records":[{"revision":"2c4acb2051754daa932bb5c5b7753290","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-81535","aliases":[],"title":"wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check","description":"In wolfSSH through 1.5.0 built with\u00A0--enable-fwd,\u00A0DoChannelOpen()\u00A0in\u00A0src/internal.c\u00A0gates only\u00A0direct-tcpip\u00A0channel opens with the forwarding policy callback.\u00A0forwarded-tcpip\u00A0opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a\u00A0forwarded-tcpip\u00A0open against the forwards it registered with a\u00A0tcpip-forward\u00A0request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.","state":0,"publishedAt":"2026-10-07T02:39:27.83+00:00","modifiedAt":"2026-10-07T18:37:36.186+00:00","affected":[{"ecosystem":"Vendor product","name":"wolfSSH","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"wolfSSL Inc.\",\n                    \"product\": \"wolfSSH\",\n                    \"repo\": \"https://github.com/wolfSSL/wolfssh\",\n                    \"modules\": [\n                        \"forwarding\"\n                    ],\n                    \"programFiles\": [\n                        \"src/internal.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.4.8\",\n                            \"lessThanOrEqual\": \"1.5.0\",\n                            \"changes\": [\n                                {\n                                    \"at\": \"1.6.0\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/wolfSSL/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8","https://github.com/wolfSSL/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c","https://github.com/wolfSSL/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81535","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-81535","identifiers":["CVE-2026-81535"]},"retained":false,"historicalAffected":[]}],"coverage":[]}