CVE-2026-2646 — Heap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION() function

CVE-2026-2646

Heap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION() function PUBLISHED

Description (CNA)

A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.

Affected (CNA)

Vendor / product	Versions
wolfssl / wolfssl	affected 0 through 5.8.4

CWE

CWE-122

References

https://github.com/wolfSSL/wolfssl/pull/9748
https://github.com/wolfSSL/wolfssl/pull/9949

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.