CVE Explorer

CVE-2025-7396

In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds. The blinding configure option is only for the base C implementation of Curve25519. It is not needed, or available with; ARM assembly builds, Intel assembly builds, and the small Curve25519 feature. While the side-channel attack on extracting a private key would be very difficult to execute in practice, enabling blinding provides an additional layer of protection for devices that may be more sus

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:3dfb36fa85e3ca3520bf435db19d4aaf5e34972de6cb0ae71e313594b7a7c3ca

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unknown","product":"wolfSSL","repo":"https://github.com/wolfssl/wolfssl","vendor":"wolfSSL","versions":[{"status":"affected","version":"5.8.0; 0"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:efeb2e687be7dd6301b3eca17ce6f48d56920ad232d8464a3d8709f0ed28d83d · sha256:5417039c2a88db07… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"PHYSICAL","baseScore":5.6,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:H/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpa…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:efeb2e687be7dd6301b3eca17ce6f48d56920ad232d8464a3d8709f0ed28d83d · sha256:5417039c2a88db07… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-385","description":"CWE-385 Covert Timing Channel","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:efeb2e687be7dd6301b3eca17ce6f48d56920ad232d8464a3d8709f0ed28d83d · sha256:5417039c2a88db07… · /containers/adp/0/problemTypes/0/descriptions/0

Source references

1 source assertion

{"url":"https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-582-july-17-2025"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:efeb2e687be7dd6301b3eca17ce6f48d56920ad232d8464a3d8709f0ed28d83d · sha256:5417039c2a88db07… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer