https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T21:21:33.078120+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-290462 EUVD-2026-290462 2026-10-16T21:21:33.139829+00:00 EUVD-2026-290462 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5503 fkie_cve-2026-5503 2026-10-16T21:21:33.139865+00:00

In TLSX_EchChangeSNI, the ctx->extensions branch set extensions unconditionally even when TLSX_Find returned NULL. This caused TLSX_UseSNI to attach the attacker-controlled publicName to the shared WOLFSSL_CTX when no inner SNI was configured. TLSX_EchRestoreSNI then failed to clean it up because its removal was gated on serverNameX != NULL. The inner ClientHello was sized before the pollution but written after it, causing TLSX_SNI_Write to memcpy 255 bytes past the allocation boundary.

 https://cve.radiocsirt.org/vuln/ghsa-65xm-pfx9-g5p3 GHSA-65xm-pfx9-g5p3 2026-10-16T21:21:33.139900+00:00

In TLSX_EchChangeSNI, the ctx->extensions branch set extensions unconditionally even when TLSX_Find returned NULL. This caused TLSX_UseSNI to attach the attacker-controlled publicName to the shared WOLFSSL_CTX when no inner SNI was configured. TLSX_EchRestoreSNI then failed to clean it up because its removal was gated on serverNameX != NULL. The inner ClientHello was sized before the pollution but written after it, causing TLSX_SNI_Write to memcpy 255 bytes past the allocation boundary.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-5503 msrc_CVE-2026-5503 — out-of-bounds write in TLSX_EchChangeSNI via attacker-controlled publicName 2026-10-16T21:21:33.139919+00:00 msrc_CVE-2026-5503 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-5503 UBUNTU-CVE-2026-5503 2026-10-16T21:21:33.139936+00:00

Affected: Ubuntu:16.04:LTS: wolfssl, Ubuntu:18.04:LTS: wolfssl, Ubuntu:20.04:LTS: wolfssl, Ubuntu:22.04:LTS: wolfssl, Ubuntu:24.04:LTS: wolfssl, Ubuntu:25.10: wolfssl, Ubuntu:26.04:LTS: wolfssl

In TLSX_EchChangeSNI, the ctx->extensions branch set extensions unconditionally even when TLSX_Find returned NULL. This caused TLSX_UseSNI to attach the attacker-controlled publicName to the shared WOLFSSL_CTX when no inner SNI was configured. TLSX_EchRestoreSNI then failed to clean it up because its removal was gated on serverNameX != NULL. The inner ClientHello was sized before the pollution but written after it, causing TLSX_SNI_Write to memcpy 255 bytes past the allocation boundary.