Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
My remote session deserialization heap OOB in wolfSSL is finally public (CVE-2026-2646). Thanks so much wolfSSL for the collaboration! Would folks be interested in a short writeup?
Post summary
The post announces that CVE‑2026‑2646, a remote session deserialization out‑of‑bounds issue in wolfSSL, has been publicly disclosed and invites a brief write‑up.
CVE-2026-2646 A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and… https://www.cve.org/CVERecord?id=CVE-2026-2646
Post summary
The tweet announces the discovery of a heap‑buffer‑overflow vulnerability in wolfSSL’s session deserialization code when SESSION_CERTS is enabled.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-2646 - Heap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION() function Intel Report: https://ift.tt/enAluI2
Post summary
A warning has been issued for CVE-2026-2646, describing a heap buffer overflow in the wolfSSL session parsing function, with no evidence of exploitation or available patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wolfssl | wolfssl | - | - | - |