Date: October 6, 2026
Severity: Medium
Affected Users: Operators of wolfSSH servers, wolfSSH versions 1.2.0 through 1.5.0. Builds with WOLFSSH_NO_DH_GEX_SHA256 defined are not affected.
Fixed In: wolfSSH v1.6.0 (PR 1221)
Summary
A wolfSSH server accepted two key exchange messages that only a server should ever send. An unauthenticated client could use one of them to make the server test an attacker-chosen number for primality, consuming CPU time, and to push the server into the client role of the key exchange.
Background
The diffie-hellman-group-exchange-sha256 key exchange (RFC 4419) lets the two sides agree on a Diffie-Hellman group instead of using a fixed one. The client sends a request with the group sizes it will accept. The server replies with SSH_MSG_KEX_DH_GEX_GROUP (31), carrying a prime and generator. The client sends its public value, and the server answers with SSH_MSG_KEX_DH_GEX_REPLY (33).
Messages 31 and 33 travel only from server to client. Because the client cannot trust the group a server hands it, the client-side handler for message 31 checks the group, including a primality test on the prime.
The Vulnerability
A wolfSSH server did not refuse messages 31 and 33. A client that negotiated diffie-hellman-group-exchange-sha256 and then sent message 31 caused the server to run the client-side group handler on the client’s data. That handler accepts a prime of up to 8192 bits and primality-tests it. For a 4096-bit prime in a packet of about 1 KB, this costs the server roughly half a second of CPU time. A client can send these repeatedly. Once the handler finishes, the server continues the key exchange in the client role.
No authentication is needed, because key exchange happens before authentication. The cost to the attacker is a small packet and the cost to the server is the primality test.
The primality-testing cost applies to wolfSSH 1.5.0. Earlier versions back to 1.2.0 also accepted the wrong-role messages, but did not do the expensive check.
The Fix
wolfSSH v1.6.0 refuses messages 31 and 33 on a server at any point in the connection, before any handler runs and before any work is done on peer-supplied values. A regression test, TestServerOnlyKexMsgsBlocked, covers this.
Related hardening in the same release applies the check in the other direction: the client refuses the key exchange messages that only a client sends (PR 1222 and 1223).
Recommendation
Update to wolfSSH v1.6.0 or later.
If you cannot update, building wolfSSH with WOLFSSH_NO_DH_GEX_SHA256 removes group exchange and the affected code path. This also removes the algorithm from what the server offers.
Credit
Thank you to Abdullah Al Ishtiaq, Kai Tu, Matthew Carter, Xiaotian Zhou, Ananna Rahman, Yilu Dong, Tianwei Yu, Ali Ranjbar and Syed Rafiul Hussain for reporting this issue.
References
- wolfSSH PR 1221
- RFC 4419, Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol
- wolfSSH v1.6.0 release
If you have questions about any of the above, please contact us at facts@wolfSSL.com or call us at +1 425 245 8247.
Download wolfSSL Now