PT-2026-62072 · S2N-Tls · S2N-Tls

CVE-2026-16318 · Published 2026-07-21 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions s2n-tls versions prior to v1.7.6

Description The QUIC transport parameters extension handler incorrectly uses s2n alloc instead of s2n realloc to store peer transport parameters. In TLS 1.3 connections involving a HelloRetryRequest, the handler is executed twice; the second call zeroes the existing pointer before allocating new memory, resulting in a memory leak. An unauthenticated user can trigger this by forcing HelloRetryRequests, leaking approximately 64 KB of memory per handshake. This leads to increased memory consumption in long-running server processes, as the memory is only reclaimed upon process restart. This issue specifically affects server-side QUIC-enabled deployments.

Recommendations Upgrade to version v1.7.6.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-16318

GHSA-CR7X-863J-XRC7

Affected Products

S2N-Tls

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16318.json · Exploit
• https://github.com/aws/s2n-tls/releases/tag/v1.7.6 · Patch
• https://osv.dev/vulnerability/CVE-2026-16318 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-16318 · Security Note
• https://staging.prod.website.marketing.aws.dev/security/security-bulletins/2026-062-aws · Vendor Advisory
• https://github.com/aws/s2n-tls/security/advisories/GHSA-cr7x-863j-xrc7 · Note