CVE-2026-11703: Missing SNI/ALPN binding on stateful (session-ID) TLS session resumption
Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual hosts, carry the cached peer-authentication state into a context it was not established for. Resumption now verifies the SNI/ALPN binding for all paths and declines (falling back to a full handshake) on mismatch.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11703?
The severity of CVE-2026-11703 is classified as medium with a CVSS score of 6.
What does CVE-2026-11703 affect?
CVE-2026-11703 affects the TLS session resumption mechanism specifically regarding SNI and ALPN binding.
How do I fix CVE-2026-11703?
To fix CVE-2026-11703, you need to apply the available patch from wolfSSL.
What is the risk associated with CVE-2026-11703?
The risk associated with CVE-2026-11703 is rated at 43, indicating a potential security issue in session-ID TLS session resumption.
When was CVE-2026-11703 published?
CVE-2026-11703 was published on June 25, 2026.