CVE-2026-16516

Name of the Vulnerable Software and Affected Versions wolfSSH (affected versions not specified)

Description wolfSSH fails to validate that the ECDSA curve identifier in a KEXDH REPLY host key blob matches the algorithm negotiated during key exchange. In the ParseECCPubKey() function, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without verifying it against the negotiated ssh->handshake->pubKeyId. Additionally, the RFC 5656 curve identifier string is discarded via GetSkip() instead of being compared. A man-in-the-middle attacker can substitute a host key blob with a different ECDSA curve, leading the client to import the key on the wrong curve. Since the attacker controls the private key for the substituted curve, signature verification succeeds. This requires an active man-in-the-middle position and a lax public key check callback, such as Trust On First Use (TOFU), algorithm-name-only checks, or fingerprint matches against the parsed key.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.