CVE-2026-2646 json
Heap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION() function
published 2026-03-19 7 mo ago modified 2026-07-25 3 mo ago also EUVD-2026-13137 , GHSA-24vq-qfc5-qrmj , JLSEC-2026-702
- cvss
- 8.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.
Patch / fix
- julia wolfSSL_jll 5.9.2+0
- wolfssl wolfssl 5.9.0
- wolfssl Alpine 3.23 5.9.1-r0
- wolfssl Alpine 3.24 5.9.0-r0
alpine advisories ALPINE-CVE-2026-2646
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- github.com/wolfSSL/wolfssl#9748 pull request
- github.com/wolfSSL/wolfssl#9949 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.0 | CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:P |
| CNA | 4.0 | 5.0 | CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| julia | wolfSSL_jll | <5.9.2+0 |
5.9.2+0 |
Affected products
- wolfssl wolfssl
Classification
References
-
github.com
/wolfSSL/wolfssl/pull/9748
issue-tracking, patch, web
-
github.com
/wolfSSL/wolfssl/pull/9949
issue-tracking, patch, web
-
github.com
/advisories/GHSA-24vq-qfc5-qrmj
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-2646
web
Sources
- CVE List CVE-2026-2646
- NVD CVE-2026-2646
- OSV JLSEC-2026-702
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.