CVE-2026-3549 — Heap-based Buffer Overflow in Wolfssl

CWE-122 — Heap-based Buffer Overflow21 documents6 sources
Severity
8.3HIGHNVD
EPSS
0.1%
top 79.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Wofssl WolfsslWolfsslDebian Wolfssl+2 more
Timeline
PublishedMar 19

Description

Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extension parsing logic when calculating a buffer length, which resulted in writing beyond the bounds of an allocated buffer. Note that in wolfSSL, ECH is off by default, and the ECH standard is still evolving.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L

Affected Packages6 packages

▶CVEListV5wofssl/wolfssl< 5.9.0
▶debiandebian/wolfssl< wolfssl 5.9.0-0.1 (forky)
▶NVDwolfssl/wolfssl< 5.9.0
▶Debianwolfssl/wolfssl< 5.9.0-0.1

Patches

Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-j2g5-52p7-mfpc: Heap Overflow in TLS 1↗2026-03-19
▶
OSV
CVE-2026-3549: Heap Overflow in TLS 1↗2026-03-19
▶

📋Vendor Advisories

2
Microsoft
ECH parsing heap buffer overflow↗2026-03-10
▶
Debian
CVE-2026-3549: wolfssl - Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extens...↗2026
▶

🕵️Threat Intelligence

16
Wiz
CVE-2026-4395 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-3580 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-3549 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-0819 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-3229 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-3549 — Heap-based Buffer Overflow in Wolfssl | cvebase