Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare processing. In the error handling path of TLSX_KeyShare_ProcessPqcHybridClient() in src/tls.c, the inner function TLSX_KeyShare_ProcessPqcClient_ex() frees a KyberKey object upon encountering an error. The caller then invokes TLSX_KeyShare_FreeAll(), which attempts to call ForceZero() on the already-freed KyberKey, resulting in writes of zero bytes over freed heap memory.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-10 | 1 | General1 |
| 2026-04-14 | 1 | Disclosure1 |
CVE-2026-5460 Heap Use-After-Free in wolfSSL TLS 1.3 Post-Quantum Cryptography Hybrid KeyShare Processing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5460
Post summary
The post discloses a heap use‑after‑free vulnerability in wolfSSL TLS 1.3 hybrid key share processing; no PoC, exploit, or remediation details are provided.
⚡ New CVE Alert: CVE-2026-5460 📊 Severity: 6.3 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-5460 #CVE-2026-5460 #CVE #Medium #CyberSecurity #InfoSec https://t.co/D5JhBTPHUL
Post summary
The tweet announces CVE‑2026‑5460 with a 6.3 severity score and links to the NVD entry, but provides no further technical or exploitation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wolfssl | wolfssl | - | - | - |