The vulnerability in wolfSSH through version 1.5.0 permits an attacker to open forwarded‑tcpip channels without any authorization check. This allows the remote SSH peer to cause the client to allocate unlimited per‑channel buffers for forwarding channels that were never explicitly requested. The lack of a counter limiting the number of such channels can be exploited to exhaust system resources and disrupt the SSH session. Additionally, the client does not validate forwarded‑tcpip opens against registered tcpip‑forward requests, so a malicious server can open forwarding channels to arbitrary addresses and ports, violating the expectations of RFC 4254 section 7.2.

Vendors and products affected are wolfSSL Inc.:wolfSSH. The issue exists in builds of wolfSSH through version 1.5.0 that are compiled with the --enable-fwd option. No specific patch version is listed, so any instance matching the described configuration is at risk.

The CVSS score of 6.3 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploit activity yet. The likely attack vector is a remote SSH peer that is allowed to initiate connections to the client—either a server or a compromised intermediate host. Because the flaw removes normal authorization checks, an attacker can repeatedly request forwarded-tcpip opens, leading to memory exhaustion. The absence of a channel count limit amplifies the impact, making denial of service a primary consequence. No explicit exploitation steps are documented, but the nature of the flaw makes it trivially exploitable by any SSH client using the vulnerable configuration.