ALPINE-CVE-2026-2646
- Source
- https://security.alpinelinux.org/vuln/CVE-2026-2646
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-2646.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALPINE-CVE-2026-2646
- Upstream
- Published
- 2026-03-19T18:16:22Z
- Modified
- 2026-11-03T06:33:02Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.
- References
Affected packages
Alpine:v3.23 / wolfssl
Package
- Name
- wolfssl
- Purl
- pkg:apk/alpine/wolfssl?arch=source