CVE-2021-3336

8.1 HIGH

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED2...

Published: 2021-01-29 · Last updated: 2026-06-17

Severity and scoring

CVSS: 8.1 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-295

Affected products

Vendor	Product
wolfssl	wolfssl

Description

DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3 servers.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3336
[Patch]https://github.com/wolfSSL/wolfssl/pull/3676
[Vendor advisory]https://www.wolfssl.com/docs/security-vulnerabilities
[Patch]https://github.com/wolfSSL/wolfssl/pull/3676
[Vendor advisory]https://www.wolfssl.com/docs/security-vulnerabilities

Related CVEs

Same vendor

CVE-2026-5194 — Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropri... (9.1 CRITICAL)
CVE-2021-38597 — wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck exte... (5.9 MEDIUM)

Same CWE

CVE-2025-71261 — An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere... (8.6 HIGH)
CVE-2026-9259 — Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier (6.5 MEDIUM)
CVE-2026-9258 — Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier (6.5 MEDIUM)
CVE-2026-45388 — In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows imp... (9.1 CRITICAL)
CVE-2026-45170 — Idira Privilege Cloud Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validati...