{"id":81083,"date":"2026-06-26T00:48:29","date_gmt":"2026-06-25T21:18:29","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2026-8720-hmac-blake2-final-discards-message-when-key-length-exceeds-block-size\/"},"modified":"2026-06-26T00:48:29","modified_gmt":"2026-06-25T21:18:29","slug":"cve-2026-8720-hmac-blake2-final-discards-message-when-key-length-exceeds-block-size","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2026-8720-hmac-blake2-final-discards-message-when-key-length-exceeds-block-size\/","title":{"rendered":"CVE-2026-8720 &#8211; HMAC-BLAKE2 final discards message when key length exceeds block size"},"content":{"rendered":"<p>CVE ID :CVE-2026-8720<\/p>\n<p>  Published : June 25, 2026, 9:18 p.m. | 26\u00a0minutes ago<\/p>\n<p>  Description :wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.<\/p>\n<p>  Severity: 5.9 | MEDIUM<\/p>\n<p>  Visit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID :CVE-2026-8720 Published : June 25, 2026, 9:18 p.m. | 26\u00a0minutes ago Description :wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-81083","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/81083","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=81083"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/81083\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=81083"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=81083"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=81083"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}