CVE-2026-5503 — out-of-bounds write in TLSX_EchChangeSNI via attacker-controlled publicName

CVE-2026-5503

out-of-bounds write in TLSX_EchChangeSNI via attacker-controlled publicName PUBLISHED

Description (CNA)

In TLSX_EchChangeSNI, the ctx->extensions branch set extensions unconditionally even when TLSX_Find returned NULL. This caused TLSX_UseSNI to attach the attacker-controlled publicName to the shared WOLFSSL_CTX when no inner SNI was configured. TLSX_EchRestoreSNI then failed to clean it up because its removal was gated on serverNameX != NULL. The inner ClientHello was sized before the pollution but written after it, causing TLSX_SNI_Write to memcpy 255 bytes past the allocation boundary.

Affected (CNA)

Vendor / product	Versions
wolfSSL / wolfSSL	affected 0 through 5.9.0

CWE

CWE-787

References

https://github.com/wolfSSL/wolfssl/pull/10102

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.