{"url":"http://public2.vulnerablecode.io/api/packages/132590?format=json","purl":"pkg:apk/alpine/wolfssl@5.8.4-r0?arch=armhf&distroversion=v3.24&reponame=community","type":"apk","namespace":"alpine","name":"wolfssl","version":"5.8.4-r0","qualifiers":{"arch":"armhf","distroversion":"v3.24","reponame":"community"},"subpath":"","is_vulnerable":false,"next_non_vulnerable_version":"5.9.0-r0","latest_non_vulnerable_version":"5.9.1-r0","affected_by_vulnerabilities":[],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/122560?format=json","vulnerability_id":"VCID-d53m-u8a8-j3dw","summary":"Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a call to the function wc_XChaCha20Poly1305_Decrypt() which is not used with TLS connections, only from direct calls from an application.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-11931","reference_id":"","reference_type":"","scores":[{"value":"0.00025","scoring_system":"epss","scoring_elements":"0.07416","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-11931"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11931","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11931"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121196","reference_id":"1121196","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121196"},{"reference_url":"https://github.com/wolfSSL/wolfssl/pull/9223","reference_id":"9223","reference_type":"","scores":[{"value":"2.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-24T15:41:59Z/"}],"url":"https://github.com/wolfSSL/wolfssl/pull/9223"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/132590?format=json","purl":"pkg:apk/alpine/wolfssl@5.8.4-r0?arch=armhf&distroversion=v3.24&reponame=community","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.8.4-r0%3Farch=armhf&distroversion=v3.24&reponame=community"}],"aliases":["CVE-2025-11931"],"risk_score":0.9,"exploitability":"0.5","weighted_severity":"1.9","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-d53m-u8a8-j3dw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/122387?format=json","vulnerability_id":"VCID-nctg-w5ay-jqaa","summary":"Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a denial-of-service by sending a crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group, leading to excessive CPU and memory consumption during ClientHello processing.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-11936","reference_id":"","reference_type":"","scores":[{"value":"0.0005","scoring_system":"epss","scoring_elements":"0.15868","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-11936"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11936","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11936"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121202","reference_id":"1121202","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121202"},{"reference_url":"https://github.com/wolfSSL/wolfssl/pull/9117","reference_id":"9117","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-24T16:19:13Z/"}],"url":"https://github.com/wolfSSL/wolfssl/pull/9117"},{"reference_url":"https://github.com/wolfSSL/wolfssl","reference_id":"wolfssl","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-24T16:19:13Z/"}],"url":"https://github.com/wolfSSL/wolfssl"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/132590?format=json","purl":"pkg:apk/alpine/wolfssl@5.8.4-r0?arch=armhf&distroversion=v3.24&reponame=community","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.8.4-r0%3Farch=armhf&distroversion=v3.24&reponame=community"}],"aliases":["CVE-2025-11936"],"risk_score":2.9,"exploitability":"0.5","weighted_severity":"5.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nctg-w5ay-jqaa"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/122388?format=json","vulnerability_id":"VCID-tav9-1pth-2qc8","summary":"Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a denial-of-service via a crafted ClientHello message with duplicate CKS extensions.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-11933","reference_id":"","reference_type":"","scores":[{"value":"0.00064","scoring_system":"epss","scoring_elements":"0.20042","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-11933"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11933","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11933"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121198","reference_id":"1121198","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121198"},{"reference_url":"https://github.com/wolfSSL/wolfssl/pull/9132","reference_id":"9132","reference_type":"","scores":[{"value":"2.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-24T16:20:56Z/"}],"url":"https://github.com/wolfSSL/wolfssl/pull/9132"},{"reference_url":"https://github.com/wolfSSL/wolfssl","reference_id":"wolfssl","reference_type":"","scores":[{"value":"2.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-24T16:20:56Z/"}],"url":"https://github.com/wolfSSL/wolfssl"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/132590?format=json","purl":"pkg:apk/alpine/wolfssl@5.8.4-r0?arch=armhf&distroversion=v3.24&reponame=community","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.8.4-r0%3Farch=armhf&distroversion=v3.24&reponame=community"}],"aliases":["CVE-2025-11933"],"risk_score":1.1,"exploitability":"0.5","weighted_severity":"2.1","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tav9-1pth-2qc8"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:apk/alpine/wolfssl@5.8.4-r0%3Farch=armhf&distroversion=v3.24&reponame=community"}