Skip to content
OpenAdvisories
Medium · 6.3 Public exploit CVE-2026-6330 EUVD-2026-39570GHSA-89v8-3927-wfcg

ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

Published Jun 25, 2026 · Updated Jun 26, 2026 · Assigned by wolfSSL

Vendor: wolfSSL Product: wolfSSL Package: wolfssl Package: wolfssl Package: wolfssl Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating party could fail to detect a manipulated ciphertext and proceed without the standard's required implicit rejection.

Affected products

VendorProductAffectedFixed
wolfSSL wolfSSL 5.7.4 – ≤ 5.9.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 wolfssl No fix yet —
Debian 12 wolfssl No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 wolfssl No fix yet —
Ubuntu 26.04 LTS wolfssl No fix yet —
Ubuntu 25.10 wolfssl No fix yet —
Ubuntu 24.04 LTS wolfssl No fix yet —
Ubuntu 22.04 LTS wolfssl No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS wolfssl No fix yet —
Ubuntu 18.04 LTS wolfssl No fix yet —
Ubuntu 16.04 LTS wolfssl No fix yet —

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 wolfssl 5.9.2-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • 007bsd/ml-kem-key-recovery ★ 0 · Jul 22, 2026

    Full ML-KEM-1024 key recovery from a partial Fujisaki-Okamoto comparison in wolfSSL (CVE-2026-6330 NEON, CVE-2026-10097 AVX2)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References