Vulnerability · Published Jun 25, 2026 · Assigned by wolfSSL
CVE-2026-6679DTLS 1.3 ACK serialization heap buffer overflow via integer truncation
High 8.8
In plain English
A high-severity out-of-bounds write in wolfSSL from wolfSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 release.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | wolfssl | 5.9.2-r0 | ALPINE-CVE-2026-6679 |
| Debian:12 | wolfssl | no fix listed | DEBIAN-CVE-2026-6679 |
| Debian:13 | wolfssl | no fix listed | DEBIAN-CVE-2026-6679 |
| Ubuntu:22.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-6679 |
| Ubuntu:24.04:LTS | wolfssl | no fix listed | UBUNTU-CVE-2026-6679 |
| Ubuntu:25.10 | wolfssl | no fix listed | UBUNTU-CVE-2026-6679 |
Affected products (as reported)
Weakness: CWE-787, CWE-190, CWE-197 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N