CVE-2026-103415: Security vulnerability
When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate.
Only the client path is affected.
Event History
Frequently Asked Questions
Which systems are exposed?
Only TLS 1.3 client-side code is affected. A system is exposed when it connects as a client to a malicious or compromised TLS server that sends a HelloRetryRequest containing an oversized cookie.
Does an attacker need a valid server certificate to trigger the issue?
No. The cookie is processed and copied into the second ClientHello before certificate authentication completes, so the server can trigger the out-of-bounds write without presenting a valid certificate.
What condition makes exploitation possible?
The caller-supplied TLS packet buffer must not have enough remaining space for the peer-controlled cookie copied into the second ClientHello. The client does not check whether that cookie fits before writing it.