JLSEC-2026-673
- Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-673.md
- Import Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-673.json
- JSON Data
- https://api.osv.dev/v1/vulns/JLSEC-2026-673
- Upstream
- Published
- 2026-07-14T21:41:35.775Z
- Modified
- 2026-07-16T17:31:33.068485749Z
- Summary
- [none]
- Details
-
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list of duplicate cipher suites to trigger the buffer overflow. In total, two Client Hellos have to be sent: one in the resumed session, and a second one as a response to a Hello Retry Request message.
- Database specific
{ "sources": [ { "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-39173", "published": "2022-09-29T01:15:11.373Z", "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39173", "modified": "2026-06-17T04:57:51.080Z", "imported": "2026-07-14T21:22:48.570Z", "id": "CVE-2022-39173", "database_specific": { "status": "Modified" } } ], "license": "CC-BY-4.0" }- References
-
- http://packetstormsecurity.com/files/169600/wolfSSL-Buffer-Overflow.html
- http://seclists.org/fulldisclosure/2022/Oct/24
- https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/
- https://github.com/wolfSSL/wolfssl/releases
- https://www.wolfssl.com/docs/security-vulnerabilities/