PT-2026-26338 · Nginx+8 · Nginx+8

Oleh Konko · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-3547

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions wolfSSL versions 5.8.4 and earlier

Description An out-of-bounds read issue exists in the ALPN (Application-Layer Protocol Negotiation) parsing functionality when ALPN is enabled. This occurs due to incomplete validation of the ALPN protocol list. A specially crafted ALPN protocol list can trigger this issue, potentially leading to a denial of service through a process crash. ALPN is disabled by default but is enabled when using certain compatibility features, including those for Apachehttpd, Bind, cURL, HAProxy, Hitch, Lighty, JNI, Nginx, and QUIC.

Recommendations wolfSSL versions prior to 5.8.4 should be updated.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-3547

Affected Products

Apache Httpd

Bind

Haproxy

Hitch

Jni

Lighty

Nginx

Curl

Wolfssl

References · 11

• https://github.com/wolfSSL/wolfssl/pull/9859 · Patch
• https://ubuntu.com/security/CVE-2026-3547 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-3547 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3547 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-3547 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3547 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3547 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl/pull/9860 · Note
• https://twitter.com/infoflowcloud/status/2035994050927509577 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034764776291643898 · Twitter Post
• https://twitter.com/CVEnew/status/2035992553208594559 · Twitter Post