CVE-2026-2646
Heap Buffer Overflow in wolfSSL_d2i_SSL_SESSION() Allows Memory Corruption
Publication date: 2026-03-19
Last updated on: 2026-04-29
Assigner: wolfSSL Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wolfssl | wolfssl | to 5.9.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "This vulnerability is a heap-buffer-overflow in the wolfSSL library's function wolfSSL_d2i_SSL_SESSION(). It occurs when deserializing SSL session data with SESSION_CERTS enabled. The function reads certificate and session ID lengths from untrusted input without proper bounds checking, which allows an attacker to overflow fixed-size buffers and corrupt heap memory."}, {'type': 'paragraph', 'content': 'To exploit this, a maliciously crafted session must be loaded from an external source. Internal sessions are not vulnerable.'}] [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to heap memory corruption due to buffer overflow when processing maliciously crafted SSL session data. Such memory corruption can cause undefined behavior including crashes, denial of service, or potentially allow an attacker to execute arbitrary code or escalate privileges within the affected system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-2646 vulnerability, you should update wolfSSL to version 5.9.0 or later, which includes patches that add explicit bounds checks on length fields in the wolfSSL_d2i_SSL_SESSION function.
- Ensure that your wolfSSL library is upgraded to at least version 5.9.0 where the fix has been merged.
- Avoid loading maliciously crafted external SSL session data until the update is applied.
These steps prevent buffer overflow by validating session certificate and session ID lengths before copying data into fixed-size buffers.