Vulnerability · Published Mar 19, 2026 · Assigned by wolfSSL
CVE-2026-2646Heap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION() function
Medium 5.0
In plain English
A medium-severity heap buffer overflow in wolfssl from wolfssl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | wolfssl | 5.9.1-r0 | ALPINE-CVE-2026-2646 |
| Alpine:v3.24 | wolfssl | 5.9.0-r0 | ALPINE-CVE-2026-2646 |
| Debian:12 | wolfssl | no fix listed | DEBIAN-CVE-2026-2646 |
| Debian:13 | wolfssl | no fix listed | DEBIAN-CVE-2026-2646 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-2646 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-2646 |
| Ubuntu:25.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-2646 |
| Ubuntu:26.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-2646 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:P