CVE-2026-84897: CWE-372 Incomplete Internal State Distinction in wolfSSL Inc. wolfSSH

The vulnerability arises from wolfSSH's server code not properly distinguishing message direction during the Diffie-Hellman group exchange key negotiation. Specifically, after processing the client's KEXINIT message, the server's state machine does not set an expected message ID, causing the function IsMessageAllowedServer() to accept a range of messages (30 through 34) indiscriminately. An unauthenticated client can exploit this by sending SSH_MSG_KEX_DH_GEX_GROUP (31), causing the server to run the client-side handler DoKexDhGexGroup(). This handler validates the attacker-supplied prime group with two 8-round Miller-Rabin primality tests on values up to 8192 bits, then stores the prime and generator, generates a Diffie-Hellman key pair in the attacker's group, and sends back SSH_MSG_KEX_DH_GEX_INIT (32). The primality tests were introduced in version 1.5.0; earlier versions (1.2.0 through 1.4.22) accept the message but skip the primality cost. The message SSH_MSG_KEX_DH_GEX_REPLY (33) is also accepted but rejected early due to missing public key checks, so it does not impose similar costs. Builds compiled with WOLFSSH_NO_DH_GEX_SHA256 or related flags are not vulnerable.

An unauthenticated attacker can send specially crafted Diffie-Hellman group exchange messages to the wolfSSH server, causing it to perform expensive cryptographic operations including large primality tests and key generation using attacker-controlled parameters. This can lead to resource exhaustion or denial of service conditions. There is no indication of direct compromise or code execution from this vulnerability. The impact is primarily a denial of service or resource consumption attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Builds that define WOLFSSH_NO_DH_GEX_SHA256, WOLFSSH_NO_DH, or NO_SHA256 are not affected by this issue. Users should monitor wolfSSL Inc. advisories for official fixes or updates addressing this vulnerability. Until a patch is available, consider disabling the Diffie-Hellman group exchange SHA256 feature if feasible.