PT-2026-31816 · Wolfssl · Wolfssl

Published 2026-04-09 · Updated 2026-04-30 · CVE-2026-5503

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WolfSSL (affected versions not specified)

Description The TLSX EchChangeSNI function incorrectly set extensions even when TLSX Find returned NULL. This allowed TLSX UseSNI to attach an attacker-controlled publicName to the shared WOLFSSL CTX when no inner SNI was configured. TLSX EchRestoreSNI then failed to remove this malicious extension because its removal depended on serverNameX not being NULL. The ClientHello was sized before the pollution but written after, leading to TLSX SNI Write copying 255 bytes beyond the allocated memory boundary.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-5503

Affected Products

Wolfssl

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-5503 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-5503 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5503 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5503 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5503 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5503 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl/pull/10102 · Note
• https://twitter.com/infoflowcloud/status/2042389884074135706 · Twitter Post
• https://t.me/msrcreports/4081 · Telegram Post
• https://twitter.com/CVEnew/status/2042387941427908991 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044062380410183879 · Twitter Post