{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "1.5.0"
              },
              {
                "introduced": "1.2.0"
              },
              {
                "fixed": "1.4.22"
              }
            ],
            "source": [
              "DESCRIPTION",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8643d7be841184f766374e3b0ed68ced6391543c"
            },
            {
              "introduced": "815d2919d5785a89714e91b49c84b1fcd8bb4235"
            },
            {
              "fixed": "7d4829843625eb7f59216136a9f21e1f986a8c2e"
            },
            {
              "fixed": "a472f1ee2b653f623d85ef2297321733f1dbfd22"
            }
          ],
          "repo": "https://github.com/wolfssl/wolfssh",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "wolfSSL",
    "cwe_ids": [
      "CWE-372",
      "CWE-400",
      "CWE-405"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84897.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "introduced": "1.2.0"
          },
          {
            "fixed": "1.6.0"
          }
        ],
        "source": "AFFECTED_FIELD"
      },
      {
        "extracted_events": [
          {
            "introduced": "30"
          },
          {
            "fixed": "34"
          }
        ],
        "source": "DESCRIPTION"
      }
    ]
  },
  "details": "src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_REPLY (33) when a server receives them from an unauthenticated client. IsMessageAllowedServer() applies no direction check to the key exchange message range: when the peer is keying and no particular message is expected, which is the state a server is in for the whole window after it processes the client's KEXINIT because nothing sets handshake-\u003eexpectMsgId there, the function falls out of its expectation branch without a verdict and reaches a numeric bound that admits every message id from 30 through 34. A client that negotiates diffie-hellman-group-exchange-sha256 and then sends message 31 makes the server run the client-side handler DoKexDhGexGroup(), which validates the attacker-supplied group with two 8-round Miller-Rabin primality tests, one on p and one on (p-1)/2, on a value of up to 8192 bits. The handler then returns success: the server stores the attacker's prime and generator, generates a Diffie-Hellman key pair in the attacker's group, and sends the client-role message SSH_MSG_KEX_DH_GEX_INIT (32) back to the attacker. Published RFC 3526 safe primes are the worst-case input and cost the attacker nothing to obtain. The primality validation was added in 1.5.0; versions from 1.2.0 through 1.4.22 admit the same message and enter the same client-role path without the primality cost. Message 33 is admitted as well, but on a server it is rejected before any cryptography because no public key check callback is registered, so it carries no comparable cost. Builds that define WOLFSSH_NO_DH_GEX_SHA256, which is implied by WOLFSSH_NO_DH or NO_SHA256, are unaffected.",
  "id": "CVE-2026-84897",
  "modified": "2026-10-09T02:31:08.679443720Z",
  "published": "2026-10-07T02:42:28.388Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84897.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84897"
    },
    {
      "type": "FIX",
      "url": "https://github.com/wolfSSL/wolfssh/commit/a472f1ee2b653f623d85ef2297321733f1dbfd22"
    },
    {
      "type": "FIX",
      "url": "https://github.com/wolfSSL/wolfssh/pull/1221"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wolfSSL/wolfssh"
    },
    {
      "type": "ARTICLE",
      "url": "https://www.rfc-editor.org/rfc/rfc3526.html"
    },
    {
      "type": "ARTICLE",
      "url": "https://www.rfc-editor.org/rfc/rfc4419.html"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:Y",
      "type": "CVSS_V4"
    }
  ],
  "summary": "wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion"
}