CVE-2026-81535

Name of the Vulnerable Software and Affected Versions wolfSSH versions prior to 1.5.1

Description When built with the --enable-fwd flag, the DoChannelOpen() function in src/internal.c only applies the forwarding policy callback to direct-tcpip channel opens. Consequently, forwarded-tcpip opens are permitted without authorization checks and are not limited in number, which allows a malicious SSH peer to force an endpoint to allocate unbounded per-channel buffers for unauthorized forwarding channels. Additionally, the client fails to verify forwarded-tcpip opens against registered forwards from tcpip-forward requests, as required by RFC 4254 section 7.2, enabling a malicious server to open forwarding channels for unauthorized addresses and ports.

Recommendations Update wolfSSH to a version later than 1.5.0. As a temporary mitigation, avoid building the software with the --enable-fwd flag.