CVE-2026-3549
ECH parsing heap buffer overflow
Summary
ECH parsing heap buffer overflow
Original description
The description as published by the source.
Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extension parsing logic when calculating a buffer length, which resulted in writing beyond the bounds of an allocated buffer. Note that in wolfSSL, ECH is off by default, and the ECH standard is still evolving.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-3549 wolfssl
- Ubuntu UBUNTU-CVE-2026-3549 wolfssl
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com