wolfSSL wolfSSH up to 1.4.20 SCP wolfSSH_CleanPath heap-based overflow

Summaryinfo

A vulnerability identified as critical has been detected in wolfSSL wolfSSH up to 1.4.20. This issue affects the function wolfSSH_CleanPath of the component SCP Handler. The manipulation leads to heap-based overflow. This vulnerability is documented as CVE-2025-15382. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in wolfSSL wolfSSH up to 1.4.20. This issue affects the function wolfSSH_CleanPath of the component SCP Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte.

The weakness was released by Luigino Camastra. The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-15382 since 12/30/2025. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 1.4.21 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-0989). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• wolfSSL

Name

• wolfSSH

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7
• 1.4.8
• 1.4.9
• 1.4.10
• 1.4.11
• 1.4.12
• 1.4.13
• 1.4.14
• 1.4.15
• 1.4.16
• 1.4.17
• 1.4.18
• 1.4.19
• 1.4.20

License

• open-source

Website

• Product: https://github.com/wolfSSL/wolfssh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion