CVE-2026-5503

Description

In TLSX_EchChangeSNI, the ctx->extensions branch set extensions unconditionally even when TLSX_Find returned NULL. This caused TLSX_UseSNI to attach the attacker-controlled publicName to the shared WOLFSSL_CTX when no inner SNI was configured. TLSX_EchRestoreSNI then failed to clean it up because its removal was gated on serverNameX != NULL. The inner ClientHello was sized before the pollution but written after it, causing TLSX_SNI_Write to memcpy 255 bytes past the allocation boundary.

PUBLISHED Reserved 2026-04-03 | Published 2026-04-09 | Updated 2026-04-10 | Assigner wolfSSL

Problem types

CWE-787 Out-of-bounds write

Product status

Credits

Calif.io in collaboration with Claude and Anthropic Research finder

References

github.com/wolfSSL/wolfssl/pull/10102

cve.org (CVE-2026-5503)

nvd.nist.gov (CVE-2026-5503)

Download JSON