wolfSSL Python module kwetsbaar voor Onjuiste Authenticatie

The core impact of CVE-2025-15346 is the circumvention of mTLS authentication. mTLS is a security protocol that requires both the client and server to present valid certificates during the TLS handshake, providing a strong layer of authentication. By exploiting this vulnerability, an attacker can connect to a server as if they were a legitimate client, potentially gaining unauthorized access to sensitive data and resources. This could include accessing APIs, databases, or other backend systems protected by mTLS. The lack of certificate verification effectively renders the mTLS implementation useless, exposing systems to significant risk. The potential for data breaches and unauthorized access is high, particularly in environments where mTLS is relied upon for critical security controls.

Systems relying on wolfssl-py for mTLS authentication are at significant risk. This includes applications and services that use wolfssl-py as a client to connect to servers requiring client certificate verification. Shared hosting environments where multiple applications share the same Python environment are particularly vulnerable, as a compromise of one application could potentially expose all others using the vulnerable wolfssl-py version.

• python / supply-chain:

import wolfssl
print(wolfssl.__version__)

• python / supply-chain:

import subprocess
result = subprocess.run(['pip', 'show', 'wolfssl'], capture_output=True, text=True)
print(result.stdout)

• python / supply-chain:

import os
if os.path.exists('/usr/local/lib/python3.x/site-packages/wolfssl/__init__.py'):
    with open('/usr/local/lib/python3.x/site-packages/wolfssl/__init__.py', 'r') as f:
        print(f.read()[:100]) # Check for version string

1. 2026-01-08Disclosure

   disclosure

1. Gereserveerd2025-12-29
2. Gepubliceerd2026-01-08
3. Gewijzigd2026-02-03
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-15346 is to upgrade to version 5.8.4.post0 or later of the wolfssl-py package. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. While not a complete solution, strengthening server-side authentication checks (e.g., verifying client IP addresses or other contextual information) can add an additional layer of defense. Review and audit all mTLS configurations to ensure proper certificate validation is enforced wherever possible. After upgrading, confirm the fix by attempting a connection without a client certificate and verifying that the connection is rejected.