CVE-2026-5479

The record

In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSL_EVP_CipherFinal (and related EVP cipher finalization functions) fails to verify the authentication tag before returning plaintext to the caller. When an application uses the EVP API to perform ChaCha20-Poly1305 decryption, the implementation computes or accepts the tag but does not compare it against the expected value.

Affected packages

Related vulnerabilities

• CVE-2026-119186 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-354
• CVE-2026-118782 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-354
• CVE-2026-118776 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-354
• CVE-2026-90720 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024… CWE-354
• CVE-2026-116608 A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. CWE-354
• CVE-2026-65625 The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified… CWE-354
• CVE-2026-115906 zip is a zip library for Rust that supports reading and writing simple ZIP files. CWE-354
• CVE-2026-89320 `HmacShaCryptor.Hash` never hashed its input. CWE-354