CVE-2025-11932: WolfSSL TLS 1.3 Information Disclosure

CVE-2025-11932 Overview

CVE-2025-11932 is a timing side-channel vulnerability in wolfSSL affecting the server-side verification of the TLS 1.3 Pre-Shared Key (PSK) binder. The server used a non-constant time comparison when validating the PSK binder, which could leak information about the binder value to an attacker on the network. The flaw is tracked under CWE-203 (Observable Discrepancy) and affects wolfSSL version 5.8.2. The maintainers addressed the issue through wolfSSL Pull Request #9223.

Critical Impact
Network-adjacent attackers could use timing measurements to recover information about the PSK binder, weakening the integrity of TLS 1.3 session resumption and PSK-based authentication.

Affected Products

wolfSSL 5.8.2
TLS 1.3 server deployments using PSK authentication or session resumption
Embedded and IoT devices linking against vulnerable wolfSSL builds

Discovery Timeline

2025-11-21 - CVE-2025-11932 published to the National Vulnerability Database
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2025-11932

Vulnerability Analysis

The vulnerability resides in the wolfSSL TLS 1.3 server code path that validates the PSK binder sent by a client during a ClientHello. The binder is a Hashed Message Authentication Code (HMAC) that proves the client possesses the pre-shared key. Correct validation requires a constant-time comparison so that execution time does not depend on how many leading bytes match the expected value.

In the affected code, the comparison ran in non-constant time. An attacker measuring server response latency across many connection attempts could infer byte-level information about the expected binder. This category of flaw matches CWE-203, where an observable behavioral discrepancy exposes sensitive data.

Root Cause

The root cause is the use of a standard memory comparison routine, rather than a timing-safe equivalent, during TLS 1.3 PSK binder verification. Standard comparisons short-circuit on the first mismatched byte, producing timing variations correlated with the secret value.

Attack Vector

Exploitation requires an attacker able to initiate TLS 1.3 handshakes against the wolfSSL server and precisely measure response timing. The attacker submits crafted ClientHello messages containing candidate binder values. Over many trials, timing differences reveal information about the correct binder, degrading the authentication guarantees that PSK provides.

No verified public proof-of-concept exploit is available. The vulnerability mechanism and fix are described in the upstream patch referenced in wolfSSL Pull Request #9223.

Detection Methods for CVE-2025-11932

Indicators of Compromise

High volumes of TLS 1.3 handshakes from a single source containing varied or malformed PSK binder values
Repeated ClientHello messages with the same PSK identity but differing binder bytes
Abnormal client reconnection patterns against servers that expose PSK-based resumption

Detection Strategies

Inventory all services and firmware images that embed wolfSSL and confirm the linked version against 5.8.2
Inspect TLS 1.3 handshake telemetry for repetitive PSK binder failures that may indicate timing probes
Compare observed wolfSSL build hashes against patched releases that include the fix from PR #9223

Monitoring Recommendations

Enable verbose TLS handshake logging on wolfSSL servers to capture binder validation failures
Alert on sustained bursts of failed PSK handshakes from the same network origin
Correlate TLS error rates with latency measurements to surface timing-oracle style probing

How to Mitigate CVE-2025-11932

Immediate Actions Required

Upgrade wolfSSL beyond version 5.8.2 to a release that incorporates the fix from wolfSSL PR #9223
Rebuild and redeploy applications, firmware, and container images that statically link wolfSSL
Rotate pre-shared keys used with TLS 1.3 PSK authentication if exposure to untrusted networks is suspected

Patch Information

The wolfSSL maintainers replaced the non-constant time binder comparison with a timing-safe implementation. The patch is tracked in wolfSSL Pull Request #9223. Operators should pull the updated source from the official wolfSSL repository and rebuild all dependent binaries.

Workarounds

Disable TLS 1.3 PSK authentication and session resumption where feasible until patched builds are deployed
Restrict TLS 1.3 server exposure to trusted network segments using firewall rules or mutual TLS
Rate-limit TLS handshake attempts per source address to raise the cost of timing-oracle attacks

bash

# Rebuild wolfSSL from a patched source tree
git clone https://github.com/wolfSSL/wolfssl.git
cd wolfssl
./autogen.sh
./configure --enable-tls13 --enable-psk
make && sudo make install