Vulnerability Description
With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with the connection using PSK without PFS. This happened when a server responded to a ClientHello containing psk_dhe_ke without a key_share extension. The re-use of an authenticated PSK connection that on the clients side unexpectedly did not have PFS, reduces the security of the connection.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wolfssl | Wolfssl | >= 5.8.2, < 5.8.4 |
| Apple | Macos | - |
| Linux | Linux Kernel | - |
Related Weaknesses (CWE)
References
- https://github.com/wolfSSL/wolfsslProduct
- https://github.com/wolfSSL/wolfssl/pull/9112Issue TrackingPatch
FAQ
What is CVE-2025-11935?
CVE-2025-11935 is a vulnerability with a CVSS score of 7.5 (HIGH). With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with the connection using PSK without PFS. Th...
How severe is CVE-2025-11935?
CVE-2025-11935 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-11935?
Check the references section above for vendor advisories and patch information. Affected products include: Wolfssl Wolfssl, Apple Macos, Linux Linux Kernel.