CVE-2026-3547: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-3547 is an out-of-bounds read vulnerability in wolfSSL's ALPN (Application Layer Protocol Negotiation) parsing logic caused by incomplete validation. It affects wolfSSL versions 5.8.4 and earlier (all versions before 5.9.0) when built with ALPN support enabled (HAVE_ALPN / --enable-alpn). A crafted ALPN protocol list can trigger the out-of-bounds read, potentially crashing the affected process. The vulnerability was published on March 19, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Feedly, GitHub PR).

The root cause is an incorrect loop exit condition in wolfSSL's ALPN parsing code (CWE-125: Out-of-bounds Read). Specifically, the loop variable s — which includes an offset — was incorrectly compared against size (the remaining buffer length after the offset) rather than length (the total buffer length), allowing the loop to read beyond the allocated buffer boundary (GitHub PR). An unauthenticated remote attacker can exploit this by sending a specially crafted ALPN protocol list during a TLS handshake. ALPN is disabled by default in wolfSSL but is automatically enabled when building with third-party compatibility flags: enable-apachehttpd, enable-bind, enable-curl, enable-haproxy, enable-hitch, enable-lighty, enable-jni, enable-nginx, and enable-quic (Feedly).

Successful exploitation causes an out-of-bounds memory read that leads to a process crash, resulting in a denial of service (DoS) for any application or service relying on wolfSSL with ALPN enabled. The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability does not enable code execution or data exfiltration. Services such as NGINX, HAProxy, Apache HTTPD, curl-based applications, and QUIC implementations built against a vulnerable wolfSSL version are at risk of service disruption (Feedly).

1. Reconnaissance: Identify services using wolfSSL with ALPN enabled — common targets include NGINX, HAProxy, Apache HTTPD, or curl-based services built with wolfSSL versions prior to 5.9.0.
2. Craft malicious TLS ClientHello: Construct a TLS ClientHello message containing a malformed ALPN extension with a crafted protocol list designed to trigger the off-by-one loop boundary error during parsing.
3. Send to target: Transmit the crafted TLS handshake packet to the target service's TLS port (e.g., 443). No authentication is required.
4. Trigger out-of-bounds read: The wolfSSL ALPN parsing loop reads beyond the allocated buffer due to the incorrect comparison of s against size instead of length, causing a memory access violation.
5. Achieve denial of service: The out-of-bounds read causes the process to crash, taking down the dependent service (GitHub PR, Feedly).

• Network: Unusual or malformed TLS ClientHello packets with oversized or malformed ALPN extension fields targeting services on TLS ports (e.g., 443, 8443).
• Logs: Unexpected process crashes or segmentation faults in application logs for services using wolfSSL (e.g., NGINX, HAProxy, Apache HTTPD); crash dump files generated around the time of suspicious TLS connections.
• Process: Sudden termination or restart of TLS-enabled services (NGINX worker processes, HAProxy, etc.) without administrative action, particularly following inbound TLS connection attempts.

Upgrade wolfSSL to version 5.9.0 or later, which contains the fix for the incorrect loop exit condition (GitHub PR). If immediate patching is not feasible, disable ALPN support by removing the relevant build flags (--enable-alpn, HAVE_ALPN) and rebuilding, or by avoiding the third-party compatibility build options that implicitly enable ALPN (enable-apachehttpd, enable-bind, enable-curl, enable-haproxy, enable-hitch, enable-lighty, enable-jni, enable-nginx, enable-quic). Assess which ALPN-enabling integrations are strictly necessary in your environment and disable any that are not (Feedly).

The vulnerability received routine coverage across CVE aggregation platforms and security feeds shortly after disclosure on March 19, 2026, including mentions on Mastodon and Bluesky (Feedly). A technical write-up was published by Infinitsec covering the DoS impact and affected configurations. No significant vendor statements beyond the patch PR or notable researcher commentary have been identified.