CVE-2026-5503: out-of-bounds write in TLSX_EchChangeSNI via attacker-controlled publicName
In TLSXEchChangeSNI, the ctx->extensions branch set extensions unconditionally even when TLSXFind returned NULL. This caused TLSXUseSNI to attach the attacker-controlled publicName to the shared WOLFSSLCTX when no inner SNI was configured. TLSXEchRestoreSNI then failed to clean it up because its removal was gated on serverNameX != NULL. The inner ClientHello was sized before the pollution but written after it, causing TLSXSNIWrite to memcpy 255 bytes past the allocation boundary.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5503?
CVE-2026-5503 is categorized as a high severity vulnerability due to the potential for an attacker to gain control over the shared WOLFSSL_CTX.
How do I fix CVE-2026-5503?
To fix CVE-2026-5503, update to the latest version of wolfSSL where the vulnerability has been addressed.
What impact does CVE-2026-5503 have on affected software?
CVE-2026-5503 allows an attacker to perform an out-of-bounds write, potentially compromising the integrity of the TLS connection.
Which versions of wolfSSL are affected by CVE-2026-5503?
CVE-2026-5503 affects certain versions of wolfSSL that utilize the TLSX_EchChangeSNI function without proper checks.
Is CVE-2026-5503 related to TLS security?
Yes, CVE-2026-5503 directly impacts TLS security by exploiting the TLSX_EchChangeSNI function's improper handling of attacker-controlled inputs.