https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T14:18:38.089118+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-276599 EUVD-2026-276599 2026-10-18T14:18:38.092215+00:00 EUVD-2026-276599 https://cve.radiocsirt.org/vuln/fkie_cve-2026-2646 fkie_cve-2026-2646 2026-10-18T14:18:38.092247+00:00

A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.

 https://cve.radiocsirt.org/vuln/ghsa-24vq-qfc5-qrmj GHSA-24vq-qfc5-qrmj 2026-10-18T14:18:38.092280+00:00

A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-2646 msrc_CVE-2026-2646 — Heap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION() function 2026-10-18T14:18:38.092299+00:00 msrc_CVE-2026-2646 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-2646 UBUNTU-CVE-2026-2646 2026-10-18T14:18:38.092316+00:00

Affected: Ubuntu:16.04:LTS: wolfssl, Ubuntu:18.04:LTS: wolfssl, Ubuntu:20.04:LTS: wolfssl, Ubuntu:22.04:LTS: wolfssl, Ubuntu:24.04:LTS: wolfssl, Ubuntu:25.10: wolfssl, Ubuntu:26.04:LTS: wolfssl

A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.