High severity8.1NVD Advisory· Published Mar 19, 2026· Updated Apr 29, 2026
CVE-2026-2646
CVE-2026-2646
Description
A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/wolfSSL/wolfssl/pull/9748nvdIssue TrackingPatch
- github.com/wolfSSL/wolfssl/pull/9949nvdIssue TrackingPatch
News mentions
0No linked articles in our index yet.