CVE-2026-81535
Reported by wolfssl · Published October 7, 2026
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| wolfssh | Alpine | 1.6.0-r0 |
| wolfssh | wolfssh | 1.6.0 |
| wolfSSH | wolfSSL Inc. | 1.5.0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| wolfSSL Inc. | wolfSSH | 1.4.8 |
| alpine | wolfssh | 0 |
| wolfSSL Inc. | wolfSSH | 1.4.8 |
Timeline
- Oct 7, 2026 EPSS Score (9 in total, the first dated here)
- Oct 7, 2026 CVE Published
- Oct 7, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-81535
vulnetix vdb fixes CVE-2026-81535Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-81535/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart