CVE-2026-2646
High
Description
A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.
SeverityHigh
CVSS8.1
Exploit probability—
ProductWolfssl
PublishedMar 19, 2026
First seenMar 19, 2026
Weakness typeCWE-122CWE-122
How to fix
Update
- wolfssl wolfssl5.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wolfssl wolfssl | v < 5.9.0 | 5.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.