Vulnerability Details CVE-2026-81535
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 18.6%
CVSS Severity
CVSS v3 Score 9.1
References
Products affected by CVE-2026-81535
-
cpe:2.3:a:wolfssh:wolfssh:0.1
-
cpe:2.3:a:wolfssh:wolfssh:0.2.0
-
cpe:2.3:a:wolfssh:wolfssh:1.0.0
-
cpe:2.3:a:wolfssh:wolfssh:1.1.0
-
cpe:2.3:a:wolfssh:wolfssh:1.2.0
-
cpe:2.3:a:wolfssh:wolfssh:1.2.2
-
cpe:2.3:a:wolfssh:wolfssh:1.3.0
-
cpe:2.3:a:wolfssh:wolfssh:1.3.1
-
cpe:2.3:a:wolfssh:wolfssh:1.4.0
-
cpe:2.3:a:wolfssh:wolfssh:1.4.10
-
cpe:2.3:a:wolfssh:wolfssh:1.4.11
-
cpe:2.3:a:wolfssh:wolfssh:1.4.12
-
cpe:2.3:a:wolfssh:wolfssh:1.4.13
-
cpe:2.3:a:wolfssh:wolfssh:1.4.15
-
cpe:2.3:a:wolfssh:wolfssh:1.4.16
-
cpe:2.3:a:wolfssh:wolfssh:1.4.17
-
cpe:2.3:a:wolfssh:wolfssh:1.4.18
-
cpe:2.3:a:wolfssh:wolfssh:1.4.19
-
cpe:2.3:a:wolfssh:wolfssh:1.4.2
-
cpe:2.3:a:wolfssh:wolfssh:1.4.20
-
cpe:2.3:a:wolfssh:wolfssh:1.4.21
-
cpe:2.3:a:wolfssh:wolfssh:1.4.22
-
cpe:2.3:a:wolfssh:wolfssh:1.4.3
-
cpe:2.3:a:wolfssh:wolfssh:1.4.4
-
cpe:2.3:a:wolfssh:wolfssh:1.4.5
-
cpe:2.3:a:wolfssh:wolfssh:1.4.6
-
cpe:2.3:a:wolfssh:wolfssh:1.4.7
-
cpe:2.3:a:wolfssh:wolfssh:1.4.8
-
cpe:2.3:a:wolfssh:wolfssh:1.4.9
-
cpe:2.3:a:wolfssh:wolfssh:1.5.0