The vulnerability in wolfSSL arises from an improper validation of the key_share extension during the TLS 1.3 HelloRetryRequest handshake. The flaw, a classic input validation failure (CWE-20), allows an attacker to send a crafted HelloRetryRequest followed by a ServerHello that omits the required key_share. Because the client mistakenly derives predictable traffic secrets from the shared key, the confidentiality of all encrypted data in that TLS session is compromised, though the server’s authentication remains unaffected.

This issue affects the wolfSSL library in all releases that implement the described TLS 1.3 handshake behavior before the patch. No specific version numbers are listed in the CNA data, but every build using the affected HelloRetryRequest logic is potentially vulnerable.

The CVSS score of 1.2 classifies the flaw as low severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not currently tracked in the CISA KEV catalog. Exploitation requires an attacker who can observe or influence a TLS handshake to inject the malformed sequence, making practical exploitation challenging. Nevertheless, the confidentiality loss warrants prompt remediation.