PT-2026-26338 · Nginx+8 · Nginx+8

Oleh Konko · Publicado 2026-03-19 · Atualizado 2026-03-23 · CVE-2026-3547

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions wolfSSL versions 5.8.4 and earlier

Description An out-of-bounds read issue exists in the ALPN (Application-Layer Protocol Negotiation) parsing functionality when ALPN is enabled. This occurs due to incomplete validation of the ALPN protocol list. A specially crafted ALPN protocol list can trigger this issue, potentially leading to a denial of service through a process crash. ALPN is disabled by default but is enabled when using certain compatibility features, including those for Apachehttpd, Bind, cURL, HAProxy, Hitch, Lighty, JNI, Nginx, and QUIC.

Recommendations wolfSSL versions prior to 5.8.4 should be updated.

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2026-3547

Produtos afetados

Apache Httpd

Bind

Haproxy

Hitch

Jni

Lighty

Nginx

Curl

Wolfssl

Referências · 11

• https://github.com/wolfSSL/wolfssl/pull/9859 · Correção
• https://github.com/wolfSSL/wolfssl/pull/9860 · Nota
• https://ubuntu.com/security/CVE-2026-3547 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2035994050927509577 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-3547 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034764776291643898 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-3547 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-3547 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3547 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3547 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2035992553208594559 · Publicação no Twitter