{"id":"CVE-2026-81535","summary":"wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check","details":"In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.","modified":"2026-10-13T02:47:02.242219370Z","published":"2026-10-07T02:39:27.830Z","database_specific":{"cwe_ids":["CWE-862","CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81535.json","cna_assigner":"wolfSSL"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81535.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81535"},{"type":"FIX","url":"https://github.com/wolfSSL/wolfssh/commit/616eb681e70759c30c3ba158f2b18d7bd954def8"},{"type":"FIX","url":"https://github.com/wolfSSL/wolfssh/commit/79a7f299337a28aa561409688a268d0efe6e295c"},{"type":"FIX","url":"https://github.com/wolfSSL/wolfssh/commit/e396a0a4b6b367f10270287446a4be0071742b5c"},{"type":"PACKAGE","url":"https://github.com/wolfSSL/wolfssh"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wolfssl/wolfssh","events":[{"introduced":"ed97707a9c58d392fdbbbeaa1b3df0faa96d82d2"},{"fixed":"8221e4ee48c93da6cea3325a91de2ecc00ae5f56"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"1.4.8"},{"fixed":"1.6.0"}]}}],"versions":["v1.5.0-stable","v1.4.22-stable","v1.4.21-stable","v1.4.20-stable","v1.4.19-stable","v1.4.18-stable","v1.4.17-stable","v1.4.15-stable","v1.4.16","v1.4.14-stable","v1.4.13-stable","v1.4.12-stable","v1.4.11-stable","v1.4.10-stable","v1.4.9","v1.4.8-stable"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81535.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}