In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. (WOLFSSL_CALLBACKS is only intended for debugging.)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HWolfssl
APPWolfssl< 5.5.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
References
Related vulnerabilities
CVE-2026-5194CRITICAL9.3PL ✓ten sam produkt
WolfSSL: nieprawidłowa weryfikacja rozmiaru skrótu w certyfikatach ECDSA
CVE-2024-5991CRITICAL10.0PL ✓ten sam produkt
WolfSSL: odczyt poza granicami bufora w funkcji MatchDomainName()
CVE-2023-3724CRITICAL9.1ten sam produkt
If a TLS 1.3 client gets neither a PSK (pre shared key) extension nor a KSE (key share extension) when connect...
CVE-2022-23408CRITICAL9.1ten sam produkt
wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections (without AE...
CVE-2021-37155CRITICAL9.8ten sam produkt
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP ...