This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-15442 →

UBUNTU-CVE-2026-15442

In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a...

Original description

The description as published by the source.

In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to a heap-use-after free. If an application ended up getting a partial wolfSSL_read() which is sometimes caused by a small user buffer passed in, then called wolfSSL_shutdown for a bidirectional close and attempted to wolfSSL_read() again while the peer continues trying to send data during the shutdown it would lead to a state where a potential heap-use-after free happened.

Source: OSV.dev (Open Source Vulnerabilities) OSV