← Vulnerability feed

Vulnerability record · CVE-2020-36177 · published 6 January 2021

CVE-2020-36177: Wolfssl out-of-bounds write vulnerability

Wolfssl · Wolfssl

RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size.

9.8 CVSS 3.1 Critical EPSS 3.5% · top 11.2% CWE-787 · Out-of-bounds write
9.8CVSS 3.1 base score, v2 10.0
3.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26567 ExploitMailing ListThird Party Advisory
https://github.com/wolfSSL/wolfssl/commit/63bf5dc56ccbfc12a73b06327361687091a4c6f7 PatchThird Party Advisory
https://github.com/wolfSSL/wolfssl/commit/fb2288c46dd4c864b78f00a47a364b96a09a5c0f PatchThird Party Advisory
https://github.com/wolfSSL/wolfssl/pull/3426 PatchThird Party Advisory
https://github.com/wolfSSL/wolfssl/releases/tag/v4.6.0-stable Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26567 ExploitMailing ListThird Party Advisory
https://github.com/wolfSSL/wolfssl/commit/63bf5dc56ccbfc12a73b06327361687091a4c6f7 PatchThird Party Advisory
https://github.com/wolfSSL/wolfssl/commit/fb2288c46dd4c864b78f00a47a364b96a09a5c0f PatchThird Party Advisory
https://github.com/wolfSSL/wolfssl/pull/3426 PatchThird Party Advisory
https://github.com/wolfSSL/wolfssl/releases/tag/v4.6.0-stable Third Party Advisory

Track CVE-2020-36177 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-5991Wolfssl out-of-bounds read vulnerabilityIn function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the fu…EPSS 0.56%9.8CVE-2021-37155Wolfssl vulnerabilitywolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the serial number …EPSS 1.5%9.8CVE-2014-2898Wolfssl out-of-bounds read vulnerabilitywolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers an out-o…EPSS 2.8%9.8CVE-2014-2896Wolfssl out-of-bounds read vulnerabilityThe DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact an…EPSS 2.8%9.8CVE-2014-2897Wolfssl out-of-bounds read vulnerabilityThe SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows remote atta…EPSS 2.8%9.8CVE-2019-16748Wolfssl out-of-bounds read vulnerabilityIn wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there…EPSS 1.2%9.8CVE-2019-15651Wolfssl out-of-bounds read vulnerabilitywolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is misha…EPSS 1.0%9.8CVE-2019-11873Wolfssl out-of-bounds write vulnerabilitywolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size. An attacker se…EPSS 8.8%

Source: NIST National Vulnerability Database (record CVE-2020-36177), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.