CVE-2026-8720

The record

wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.

Affected packages

Related vulnerabilities

• CVE-2026-35501 When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both… CWE-354
• CVE-2026-85747 Distribution is a toolkit to pack, ship, store, and deliver container content. CWE-354
• CVE-2026-20354 Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME)… CWE-354
• CVE-2026-82549 A vulnerability was identified in Linux Foundation Magma 1.9.0. CWE-354
• CVE-2025-61480 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a… CWE-354
• CVE-2026-75803 Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can… CWE-354
• CVE-2026-12816 In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via… CWE-354
• CVE-2026-12817 In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on… CWE-354