CVE-2025-12889: WolfSSL TLS 1.2 Information Disclosure Flaw

CVE-2025-12889 Overview

CVE-2025-12889 affects wolfSSL, a lightweight Transport Layer Security (TLS) library used in embedded and IoT deployments. During TLS 1.2 handshakes, a client can select any supported digest algorithm rather than one advertised in the server's CertificateRequest message. This behavior deviates from RFC 5246, which requires the client to use a signature and hash algorithm from the server-supplied list. The flaw is categorized as improper input validation [CWE-20] and is scored as low severity because exploitation requires client-side control and yields limited confidentiality and integrity impact.

Critical Impact
A TLS 1.2 client can negotiate a weaker digest than the server intended to accept during mutual authentication, potentially downgrading signature strength on client certificate verification.

Affected Products

wolfSSL 5.8.4
wolfSSL deployments using TLS 1.2 with client certificate authentication
Embedded systems and IoT devices linking against affected wolfSSL builds

Discovery Timeline

2025-11-22 - CVE-2025-12889 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12889

Vulnerability Analysis

The issue resides in wolfSSL's TLS 1.2 client-side handling of the CertificateRequest handshake message. RFC 5246 defines a supported_signature_algorithms field that lets the server enumerate the digest and signature pairs it will accept for the subsequent CertificateVerify message. wolfSSL's client did not strictly enforce this list. As a result, the client could sign the handshake transcript with a digest that the server did not advertise, including a weaker algorithm such as SHA-1 when stronger options were available.

The impact is limited to TLS 1.2 sessions that use mutual authentication. TLS 1.3 is not affected because signature algorithm negotiation is handled differently in that protocol version. Since the client controls the digest selection, exploitation requires an attacker to influence the client rather than the server.

Root Cause

The root cause is missing validation of the server-supplied signature algorithm list before choosing a digest for the CertificateVerify message. The client-side code path selected a locally supported digest without cross-referencing entries from the CertificateRequest, violating the protocol constraint defined in [CWE-20].

Attack Vector

An attacker with control over a TLS 1.2 client, or the ability to modify client behavior in a mutual TLS deployment, can force the client to sign with a weaker digest. This may facilitate downstream attacks such as signature forgery against protocols that assume a minimum digest strength. Refer to the wolfSSL Pull Request #9395 for the code-level fix.

Detection Methods for CVE-2025-12889

Indicators of Compromise

TLS 1.2 CertificateVerify messages signed with a digest not present in the corresponding CertificateRequest signature_algorithms extension.
Client certificate authentication events using SHA-1 or other weak digests when server policy prohibits them.
Presence of wolfSSL version 5.8.4 in software bills of materials for network-facing services.

Detection Strategies

Inspect TLS handshake captures with tools such as Wireshark to compare the server's advertised signature algorithms against the digest used in the client CertificateVerify.
Enable strict TLS logging on servers to record the signature and hash algorithm chosen by the client during mutual authentication.
Audit dependency manifests for wolfSSL 5.8.4 in firmware images, container builds, and embedded device SDKs.

Monitoring Recommendations

Alert on TLS 1.2 mutual authentication events that use SHA-1 or MD5 digests in environments where policy requires SHA-256 or stronger.
Track outbound TLS connections from IoT and embedded fleets for deprecated cipher and digest usage.
Correlate wolfSSL library version telemetry with handshake anomalies observed at network chokepoints.

How to Mitigate CVE-2025-12889

Immediate Actions Required

Inventory all systems that link against wolfSSL 5.8.4 and prioritize those handling client certificate authentication.
Apply the upstream fix from wolfSSL Pull Request #9395 and rebuild dependent binaries.
Where feasible, disable TLS 1.2 in favor of TLS 1.3, which is not affected by this issue.

Patch Information

The fix is available in the wolfSSL repository via Pull Request #9395. The patch enforces that the digest selected for the TLS 1.2 CertificateVerify message must be one of the algorithms sent by the server in the CertificateRequest. Consumers of wolfSSL should upgrade to the release incorporating this change and redeploy affected firmware or applications.

Workarounds

Configure servers to require TLS 1.3 for mutual authentication where clients support it.
On the server side, reject CertificateVerify messages that use digests outside the advertised supported_signature_algorithms list.
Restrict accepted client digests to SHA-256 or stronger at the application layer when protocol-level enforcement is not possible.

bash

# Configuration example: rebuild wolfSSL with the patched source
git clone https://github.com/wolfSSL/wolfssl.git
cd wolfssl
git fetch origin pull/9395/head:fix-12889
git checkout fix-12889
./autogen.sh
./configure --enable-tls13
make && sudo make install