wolfSSH 1.6.0 Fixes Five Flaws, Including Critical Host Key Bypass CVE-2026-16516

wolfSSL released wolfSSH 1.6.0 to address five vulnerabilities in wolfSSH ≤1.5.0 — including a critical CVE-2026-16516 (CVSS 9.0) that allows a man-in-the-middle to substitute a forged ECDSA host key, plus flaws enabling pre-auth CPU exhaustion, privilege escalation on Windows, unauthorized forwarded-tcpip channels, and an off-by-one SFTP write. The report advises immediate updates, stricter host key checking, and disabling unused features (e.g., port forwarding) because many vulnerable devices (embedded/IoT) may receive slow firmware updates.